am com nonlegre · 2020. 12. 21. · am\1221158en.docx pe663.032v01-00 enunited in diversityen...

$: AM Com NonLegRE · 2020. 12. 21. · AM\1221158EN.docx PE663.032v01-00 ENUnited in diversityEN European Parliament 2019-2024 Committee on Civil Liberties, Justice and Home Affairs$
AM\1223869EN.docx PE663.032v02-00

EN United in diversity EN

European Parliament2019-2024

Committee on Civil Liberties, Justice and Home Affairs

PE663.032v01-00

03.02.2021

AMENDMENTS1 - 173Draft motion for a resolutionJuan Fernando López Aguilar(PE660.347v01-00)

Commission evaluation report on the implementation of the General Data Protection Regulation two years after its application

PE663.032v02-00 2/88 AM\1223869EN.docx

EN

AM_Com_NonLegRE

AM\1223869EN.docx 3/88 PE663.032v02-00

EN

Amendment 1Patrick Breyeron behalf of the Greens/EFA Group

Draft motion for a resolutionCitation -1 a (new)

Draft motion for a resolution Amendment

- having regard to Article 8 of the Charter of Fundamental Rights;[to be inserted before the first citation]

Or. en


Draft motion for a resolutionCitation -1 a (new)


- having regard to Article 16 of the Treaty on the Functioning of the European Union;[to be inserted before the first citation]

Or. en


Draft motion for a resolutionCitation 3 a (new)


- having regard to the Commission Communication of 24.7.2019, “Data protection rules as a trust-enabler in the

PE663.032v02-00 4/88 AM\1223869EN.docx

EN

EU and beyond – taking stock”1a;_________________1a COM (2019)374, 24.7.2019

Or. en


Draft motion for a resolutionCitation 3 b (new)


- having regard to the contribution of the European Data Protection Board (EDPB) to the evaluation of the GDPR under Article 97, adopted on 18 February 20201a;_________________1a https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_contributiongdprevaluation_20200218.pdf

Or. en


Draft motion for a resolutionCitation 3 c (new)


- having regard to the EDPB’s “First overview on the implementation of the GDPR and the roles and means of the national supervisory authorities” of 26.2.20191a;_________________

AM\1223869EN.docx 5/88 PE663.032v02-00

EN

1a https://edpb.europa.eu/sites/edpb/files/files/file1/19_2019_edpb_written_report_to_libe_en.pdf

Or. en


Draft motion for a resolutionCitation 3 d (new)


- having regard to the guidelines adopted by the EDPB pursuant to Article 70(1)(e) of the GDPR;

Or. en


Draft motion for a resolutionRecital A a (new)


A a. whereas, according to the Fundamental Rights Survey 2019 by the Fundamental Rights Agency (FRA), 69% of the EU population above the age of 16 have heard about the GDPR; whereas this shows that the mere adoption of the GDPR has already contributed to massively better awareness of data protection among EU citizens and residents;

Or. en

PE663.032v02-00 6/88 AM\1223869EN.docx

EN

Amendment 8Juan Fernando López Aguilar

Draft motion for a resolutionRecital A a (new)


A a. Whereas according to the Fundamental Rights Survey carried out by the Fundamental Rights Agency (FRA), individuals are increasingly aware of their rights under the GDPR; whereas despite the fact that organisations have put in place measures to facilitate the exercise of data subject's rights, individuals continue to face difficulties when trying to exercise those rights, particularly the right of access, portability, and enhanced transparency.

Or. en

Amendment 9Axel Voss, Roberta Metsola, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Javier Zarzalejos, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima

Draft motion for a resolutionRecital B


B. whereas, since the start of application of the GDPR, supervisory authorities have received a massive increase in complaints; whereas this illustrates that data subjects are more aware of their rights and want to protect their personal data in line with the GDPR; whereas this also illustrates that large amounts of illegal data processing operations continue to take place;

B. whereas, since the start of application of the GDPR, supervisory authorities have received a massive increase in complaints; whereas this illustrates that data subjects are more aware of their rights and want to protect their personal data in line with the GDPR;

Or. en

AM\1223869EN.docx 7/88 PE663.032v02-00

EN


Draft motion for a resolutionRecital B a (new)


B a. whereas many businesses have used the transition period between the GDPR entering into force and becoming applicable for a data “spring cleaning” to assess which data processing is actually taking place and which data processing might not be any longer needed or justified;

Or. en

Amendment 11Assita Kanko



B a. Whereas many DPAs are not able to cope with the number of complaints, whereas many DPAs are understaffed, under-resourced and lack a sufficient number of tech experts.

Or. en

Amendment 12Ramona Strugariu



B a. whereas the GDPR recognizes that

PE663.032v02-00 8/88 AM\1223869EN.docx

EN

Member States law should reconcile the rules governing freedom of expression and information, including journalistic, academic, artistic and or literary expression with the right to the protection of personal data; whereas Article 85 posits that Member States legislation should provide for exemptions for processing of data carried out for journalistic purposes or the purpose of academic artistic or literary expression, if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information;

Or. en


Draft motion for a resolutionRecital B b (new)


B b. whereas, as emphasized also by the European Data Protection Board, the protection of journalistic sources is the cornerstone of the freedom of the press; whereas GDPR should not be abused against journalists and access to information and should by no means be used by national authorities to stifle media freedom;

Or. en

Amendment 14Axel Voss, Roberta Metsola, Henna Virkkunen, Kris Peeters, Eva Maydell, Daniel Caspary, Jeroen Lenaers, Pascal Arimont, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima

Draft motion for a resolutionParagraph 1

AM\1223869EN.docx 9/88 PE663.032v02-00

EN


1. Welcomes that the GDPR has become a global standard for the protection of personal data and is a factor of convergence in the development of norms; welcomes that the GDPR has placed the EU at the forefront of international discussions about data protection and a number of third countries have aligned their data protection laws with the GDPR;

1. Welcomes that the GDPR has become a global standard for the protection of personal data and is a factor of convergence in the development of norms; welcomes that the GDPR has placed the EU at the forefront of international discussions about data protection and a number of third countries have aligned their data protection laws with the GDPR; urges the European Commission as well as Member States to use this momentum to push at UN, OECD, G8, G20 level for the creation of international standards that are shaped on European values and principles; underlines that a dominant European position in this field would help our continent to better defend the rights of our citizens, safeguard our values and principles, promote trustful digital innovation, and to accelerate the economic growth by avoiding fragmentation;

Or. en


Draft motion for a resolutionParagraph 1 a (new)


1 a. Points out that the Council of Europe Convention 108 on Data Protection has been aligned with the GDPR (“Convention 108+”) and has already been signed by 42 Countries;

Or. en

Amendment 16

PE663.032v02-00 10/88 AM\1223869EN.docx

EN

Axel Voss, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Javier Zarzalejos, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



2. Concludes that, two years after its entry into application, the GDPR has been an overall success and agrees with the European Commission that it is not necessary at this stage to update or review the legislation;

2. Takes note of the assessment of the European Commission that, two years after its entry into application, the GDPR has been an overall success; points, however, to the problems and shortcomings identified by stakeholders and confirmed by the Commission; disagrees, therefore with the Commission that it is not necessary at this stage to update or review the legislation and calls for an urgent, targeted revision aimed at rectifying the identified problems and shortcomings;

Or. en

Amendment 17Axel Voss, Roberta Metsola, Jörgen Warborn, Henna Virkkunen, Javier Zarzalejos, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



2 a. Highlights that while the GDPR - in some areas - is becoming a competitive enabler for the EU, it has not facilitated the exercise of new individual rights as originally anticipated and thwarts our efforts in the global race for future strategic technologies by unnecessarily restricting businesses in the use of available data;

Or. en

AM\1223869EN.docx 11/88 PE663.032v02-00

EN

Amendment 18Axel Voss, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Javier Zarzalejos, Daniel Caspary, Jeroen Lenaers, Pascal Arimont, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



3. Acknowledge that the focus in the coming years must continue to be on the improvement of implementation and actions to strengthen the GDPR;

3. Acknowledges that the focus, until the Commission’s next evaluation, must continue to be on the improvement of implementation and actions to strengthen the GDPR; urges the Commission in the meantime to study the effects of the GDPR on future technologies made in Europe, single out all legislative shortcomings and eventually, present plans for a more comprehensive revision;

Or. en




3. Acknowledge that the focus in the coming years must continue to be on the improvement of implementation and actions to strengthen the GDPR;

3. Acknowledges that the focus in the coming years must continue to be on the improvement of implementation and actions to strengthen the enforcement of the GDPR;

Or. en

Amendment 20Paul Tang

Draft motion for a resolution

PE663.032v02-00 12/88 AM\1223869EN.docx

EN

Paragraph 4


4. Acknowledges the need for strong and effective enforcement of the GDPR vis-à-vis large digital platforms and integrated companies, including areas such as online advertising and micro-targeting;

4. Acknowledges the need for strong and effective enforcement of the GDPR vis-à-vis large digital platforms, integrated companies and other digital services, especially on areas of online advertising, micro-targeting, algorithmic profiling, the ranking, dissemination and amplification of content and data localisation;

Or. en




4 a. Notes that the reconciliation of the right to the protection of personal data with freedom of expression and information, and the proper balancing of these rights remains a challenge for national legislations implementing GDPR; welcomes that the evaluation report looked also at the way in which Article85 has been implemented in national legislations; stresses that the reconciliation between rights must be provided for by law, respect the essence of those fundamental rights, and be proportional and necessary, while being framed by the case law of the Court of Justice and of the European Court of Human Rights;

Or. en

Amendment 22

AM\1223869EN.docx 13/88 PE663.032v02-00

EN

Ramona Strugariu

Draft motion for a resolutionParagraph 4 b (new)


4 b. Calls on the European Commission to continue closely monitoring the implementation of the GDPR legislation by national authorities so that the exercise of freedom of expression and information is not affected and that data protection rules are not interpreted as a way to put pressure on journalists to disclose their sources;

Or. en

Amendment 23Axel Voss, Henna Virkkunen, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz



5. Reminds that since the start of the application of the GDPR, “consent” means any freely, given, specific, informed and unambiguous indication of the data subject’s wishes, underlines that this also applies to the e-Privacy Directive; notes that the implementation of valid consent continues to be compromised by the use of dark patterns, tracking for commercial purposes and other unethical practices; is concerned that individuals are often put under economic pressure to give consent in return for discounts or other commercial offers, or are forced to give consent by conditioning access to a service through tying provisions, in breach of Article 7 of GDPR;

5. Reminds that since the start of the application of the GDPR, “consent” means any freely, given, specific, informed and unambiguous indication of the data subject’s wishes; notes that the implementation of valid consent continues to be compromised by the use of dark patterns and other unethical practices; notes that individuals are often encouraged to give consent in return for discounts or other commercial offers, or are forced to give consent by conditioning access to a service through tying provisions, in breach of Article 7 of GDPR;

Or. en

PE663.032v02-00 14/88 AM\1223869EN.docx

EN




5 a. Points out that controllers continue to rely on legitimate interest without conducting the required purpose and necessity test as well as the fundamental rights assessment; is particularly concerned by the fact that Member States are adopting national legislation to determine conditions for processing based on legitimate interest, by providing for the balancing of the respective interests of the controller and of the individuals concerned, while the GDPR obliges each and every controller to undertake such balancing individually and avail itself of that legal ground; calls on the EDPB to update the WP29 Opinion on the application of legitimate interest as a legal ground for processing.

Or. en




5 a. Is concerned that controllers often mention all the legal ground of the GDPR in their privacy policy without further explanation and without referring to the specific processing operation concerned; understands that such practice does not allow the data subjects and the

AM\1223869EN.docx 15/88 PE663.032v02-00

EN

supervisory authorities to assess whether such legal grounds are appropriate; urges the supervisory authorities to make sure that the controllers cannot use more than one legal ground for each processing operations and specify how each legal ground is relied upon for their processing operations;

Or. en

Amendment 26Cornelia Ernst



5 a. Is concerned that controllers often mention all the legal ground of the GDPR in their privacy policy without further explanation and without referring to the specific processing operation concerned; understands that such practice does allow the data subjects and the supervisory authorities to assess whether such legal ground are appropriate; urges the date supervisory authorities to make sure that the controllers cannot use more than one legal ground for each processing operations and specify how each legal ground is relied upon for their processing operations;

Or. en

Amendment 27Axel Voss, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz


PE663.032v02-00 16/88 AM\1223869EN.docx

EN


5 a. Reiterates that all six legal grounds for processing data, laid down in Art 6 GDPR, are equally sufficient and that consent is not the only legal ground; deplores that the guidance by national DPAs often ignores that the same processing activities can fall under different legal grounds simultaneously; states that the use of all legal grounds could also help against unfortunate adverse effects such as ‘cookie fatigue’;

Or. en




5 b. Takes note of the request of data controllers and processors for more legal clarity regarding the precise requirements to be met by data in order to be considered 'anonymised data' under the GDPR; calls upon the EDPB to review the WP29 Opinion 05/2014 on 'Anonymisation Techniques' and to establish a list of unambiguous criteria in order to achieve anonymisation under the GDPR;

Or. en



AM\1223869EN.docx 17/88 PE663.032v02-00

EN


5 b. Recalls that in order to process special categories of personal data a lawful ground under Article 6 and a separate condition for processing under Article 9 must be identified; reminds controllers of their legal obligation to conduct a data protection impact assessment (DPIA) when the processing of data is likely to result in a high risk to the rights and freedoms of natural persons.

Or. en




5 b. Is concerned that the “legitimate interest” is very often abusively mentioned as legal ground for processing; notes that the test of the balance of interests is too often not performed by the controllers to assess whether they can rely on such ground; calls upon clarification of this notion by the EDPB in its updated guidelines on legitimate interest;

Or. en




PE663.032v02-00 18/88 AM\1223869EN.docx

EN

5 b. Is concerned that the legitimate interest is abusively mentioned as legal ground for processing; notes that the balance of interests is too often not performed by the controllers to assess whether they can rely on such ground; calls upon clarification of this notion by the EDPB in its updated guidelines on legitimate interest;

Or. en

Amendment 32Axel Voss, Henna Virkkunen, Kris Peeters, Eva Maydell, Daniel Caspary, Jeroen Lenaers, Pascal Arimont, Anna-Michelle Asimakopoulou, Ralf Seekatz

Draft motion for a resolutionParagraph 5 c (new)


5 c. Calls upon the EDPB to draw up harmonised rules on what constitutes valid consent to replace the different interpretations by many national DPAs; notes that the current situation in many Member States strongly diverges from European legal traditions and civil law principles and leads to unnecessary Fragmentation within the Digital Single Market;

Or. en


Draft motion for a resolutionSubheading 2 a (new)


Notes that the COVID-19 pandemic has highlighted the need for watertight guidance from the DPAs, the EDPB and

AM\1223869EN.docx 19/88 PE663.032v02-00

EN

the Commission on the adequate implementation of the GDPR in cross-border health-related research.

Or. en

Amendment 34Axel Voss, Henna Virkkunen, Kris Peeters, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz

Draft motion for a resolutionParagraph 5 d (new)


5 d. Calls upon the EDPB to clarify the meaning of Recital 50 of the GDPR and assess whether a new legal ground is necessary for cases in which the data subject has initially given consent but where the personal data is further processed for another purpose than the purpose of the initial collection;

Or. en


Draft motion for a resolutionParagraph 5 e (new)


5 e. Stresses that a viable solution has to be found to ensure that consent can be provided in scenarios in which data is processed for one or more specific purposes - such as high-frequency communications between multiple actors for instance machine-to-machine (M2M) or vehicle-to-everything (V2X) communications - and in which obtaining valid consent may prove impossible

PE663.032v02-00 20/88 AM\1223869EN.docx

EN

otherwise;

Or. en


Draft motion for a resolutionParagraph 5 f (new)


5 f. Expresses its concern about the restrictive national interpretations of 'legitimate interest' that for instance rule out data processing for purely commercial interests, although Recital 47 GDPR lists direct marketing as an example of a valid use of 'legitimate interest', or that hamper video surveillance of retailers to protect costumers against pickpocketing;

Or. en


Draft motion for a resolutionParagraph 5 g (new)


5 g. Calls upon the EDPB to provide more guidance on legal ground when it comes to new technological developments and business models as the current interpretations are often not flexible enough (e.g. Art 6(1b) GDPR when the contract is already part of an online service); points out that some emerging technologies such as AI, with its interconnected and autonomous elements, demand the reconsideration of

AM\1223869EN.docx 21/88 PE663.032v02-00

EN

the concept of informed consent as it is no longer viable;

Or. en

Amendment 38Axel Voss, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Daniel Caspary, Jeroen Lenaers, Pascal Arimont, Anna-Michelle Asimakopoulou, Ralf Seekatz

Draft motion for a resolutionParagraph 5 h (new)


5 h. Calls upon the European Commission and the EDPB to create a user-friendly and transparent permission process to reduce the number of interactions between service providers and end-users ('cookie fatigue') while at the same time striking a balance between the protection of individual consumers and the secure processing of communications data based on pseudonymised data processing;

Or. en

Amendment 39Axel Voss, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Eva Maydell, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz

Draft motion for a resolutionParagraph 5 i (new)


5 i. Calls upon the EDPB to issue guidelines addressing the implementation of the accountability principle and clarifying the criteria for ‘high risk processing of personal data’;

Or. en

PE663.032v02-00 22/88 AM\1223869EN.docx

EN




6. Stresses that there is necessity to facilitate the exercise of individual rights provided by the GDPR, such as data portability or rights in the context of automated processing, including profiling; calls on the EDPB to issue further guidance on automated decision-making;

6. Stresses that there is necessity to facilitate the exercise of individual rights provided by the GDPR, such as data portability or rights in the context of automated processing, including profiling; calls on the EDPB to encourage online platforms to create a single point of contact for all their underlying digital platforms, wherefrom user requests can be forwarded to the correct recipient and to issue further guidance on automated decision-making;

Or. en




6. Stresses that there is necessity to facilitate the exercise of individual rights provided by the GDPR, such as data portability or rights in the context of automated processing, including profiling; calls on the EDPB to issue further guidance on automated decision-making;

6. Stresses that there is necessity to facilitate the exercise of individual rights provided by the GDPR, such as data portability or rights in the context of automated processing, including profiling; welcomes the EDPB guidelines on automated decision-making1a and on data portability1b;

_________________1a https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612053

AM\1223869EN.docx 23/88 PE663.032v02-00

EN

1b https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611233

Or. en




6 a. Highlights that compliance with the right to be informed requires companies to provide information in a concise, transparent, intelligible and easily accessible manner and to avoid taking a legalistic approach when drafting data protection notices; is concerned that companies continue to breach their obligations under Article 12(1) GDPR and fail to provide all the relevant information recommended by the EDPB, including as regards listing the names of the entities with whom they share data; recalls that the obligation to provide information that is simple and accessible is particularly strict when it comes to children.

Or. en




6 a. Calls on the EDPB to issue guidelines that classify different legitimate uses cases of profiling

PE663.032v02-00 24/88 AM\1223869EN.docx

EN

according to their risks for the rights and freedoms of data subjects, along with recommendations for appropriate technical and organisational measures, and with a clear delineation of illegal use-cases;

Or. en

Amendment 44Axel Voss, Roberta Metsola, Henna Virkkunen, Kris Peeters, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



6 a. Takes note of the current practice of professional providers to pursue their commercial self-interest by incentivising data subjects to exercise their right to information; notes that formal requirements should be introduced for tabling a request to exercise the right to information;

Or. en




6 b. Is concerned about the wide-spread lack of properly functioning data subject access mechanisms; points out that individuals are often not able to force internet platforms to reveal their behavioural profiles; is concerned that companies are notorious in ignoring the

AM\1223869EN.docx 25/88 PE663.032v02-00

EN

fact that inferred data is also personal data, subject to all safeguards under the GDPR;

Or. en

Amendment 46Axel Voss, Henna Virkkunen, Kris Peeters, Roberta Metsola, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz



6 b. Highlights the advantages of creating a standardised and automated way to interact with GDPR decisions via an application programming interface (API);

Or. en




6 c. Is concerned that individuals are often put under pressure to give consent in return for discounts or other commercial offers, or are forced to give consent by conditioning access to a service through tying provisions; condemns this as not respecting Article 7(4);

Or. en

PE663.032v02-00 26/88 AM\1223869EN.docx

EN




6 d. Points out that in line with the principle of data minimisation, the right to anonymity effectively prevents unauthorised disclosure, identity theft and other forms of abuse of personal data;

Or. en




7. Observes that some stakeholders report that the application of the GDPR is challenging especially for small and medium sized enterprises (SMEs);

7. Observes that some stakeholders report that the application of the GDPR is challenging especially for small and medium sized enterprises (SMEs); is of the opinion that the GDPR and its enforcement must not lead to a competitive disadvantage for SMEs vis-à-vis large companies; believes that more support, information and training should be made available by national authorities and European Commission information campaigns in order to aid the increase of knowledge, the quality of implementation and awareness of the requirements and purpose of the GDPR;

Or. en

Amendment 50Axel Voss, Roberta Metsola, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Javier

AM\1223869EN.docx 27/88 PE663.032v02-00

EN

Zarzalejos, Daniel Caspary, Jeroen Lenaers, Pascal Arimont, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima




7. Underlines that the application of the GDPR has been particularly challenging for small and medium sized enterprises (SMEs), start-ups, organisations associations, clubs as well as societies; notes that the compliance costs as well as legal uncertainty have strongly affected business models and investor confidence, resulting in product abandonment and entrepreneurial discouragement;

Or. en

Amendment 51Sophia in 't Veld, Michal Šimečka, Nathalie Loiseau, Olivier Chastel




7. Observes that some stakeholders report that the application of the GDPR is challenging especially for small and medium sized enterprises (SMEs), associations, and schools; notes however that many of the rights and obligations in the GDPR are not new but were already in force under Directive 95/46/EC, but hardly enforced;

Or. en

Amendment 52Axel Voss, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Javier Zarzalejos, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-

PE663.032v02-00 28/88 AM\1223869EN.docx

EN

Lima



8. Points out that there should be no derogation for SMEs; calls on the EDPB to provide practical tools to facilitate the implementation of the GDPR by SMEs with low risk processing activities;

8. Calls for the inclusion of derogations for micro enterprises, societies, clubs, associations and private citizens as they are in particular affected by the new obligations - often in solely voluntary or private capacities;

Or. en





8. Points out that there should be no derogation for SMEs, associations and schools; calls on the EDPB to provide clear information to avoid any confusion about the GDPR, and practical tools to facilitate the implementation of the GDPR by SMEs, associations, and schools with low risk processing activities; calls on the Member States to make available sufficient means for the DPAs to communicate these practical tools;

Or. en



AM\1223869EN.docx 29/88 PE663.032v02-00

EN



8. Calls on the EDPB to provide practical tools to facilitate the implementation of the GDPR by SMEs with low risk processing activities;

Or. en

Amendment 55Axel Voss, Roberta Metsola, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Javier Zarzalejos, Daniel Caspary, Jeroen Lenaers, Pascal Arimont, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



8 a. Calls upon the EDPB to create a practical GDPR tool for SMEs and furthermore requests reporting exemptions in Art 30(5) GDPR for those SMEs that do not process high-risk data; notes in this regard that the term “occasionally” is legally ambiguous and should be clarified by the EDPB;

Or. en

Amendment 56Sophia in 't Veld, Michal Šimečka, Nathalie Loiseau, Moritz Körner, Olivier Chastel



8 a. Expresses its concern that slow or even non-existent enforcement of the GDPR prolongs the "business as usual" situation under Directive 95/46/EC, where data protection law was generally neglected;

Or. en

PE663.032v02-00 30/88 AM\1223869EN.docx

EN




8 b. Calls upon the European Commission and the EDPB to build up a free of charge Privacy Policy generator that citizens, societies, clubs as well as micro-businesses can use to make and keep their website GDPR compliant; emphasises that the GDPR should no longer force private citizens or volunteers into hiring the service of law firms in order to avoid expensive legal warnings;

Or. en

Amendment 58Axel Voss, Roberta Metsola, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Eva Maydell, Javier Zarzalejos, Daniel Caspary, Jeroen Lenaers, Pascal Arimont, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



8 c. Urges the Commission to accelerate its work on modernised standard contractual clauses for international data transfers to ensure a level-playing field for SMEs at international level; notes that binding corporate rules and a European codes of conduct would also help SMEs in meeting their obligations while keeping the administrative burden for them as low as possible;

AM\1223869EN.docx 31/88 PE663.032v02-00

EN

Or. en

Amendment 59Axel Voss, Roberta Metsola, Henna Virkkunen, Kris Peeters, Eva Maydell, Daniel Caspary, Jeroen Lenaers, Pascal Arimont, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



9. Is concerned by the uneven level of enforcement of the GDPR by national data protection authorities (DPAs);

9. Is concerned by the uneven level of enforcement of the GDPR by national data protection authorities (DPAs); calls upon all Member States to strengthen the enforcement, prosecution and punishment of data protection violations as so far only the smallest percentage of data protection complaints have been pursued;

Or. en

Amendment 60Sophia in 't Veld, Michal Šimečka, Nathalie Loiseau, Moritz Körner



10. Notes that since the start of application of the GDPR, though some significant fines have been issued for cases of serious breaches, the possibilities of the GDPR in this regard have by far not been used to their full extent with discrepancies in the severity of sanctions applied across the Member States;

10. Notes that since the start of application of the GDPR, some significant fines have been issued for cases of serious breaches; regrets however that the amount of the fines varies significantly across the Member States and that some fines issued to large companies are too low to have the intended deterring effect against data protection violations; calls on the DPAs to make full use of the possibilities in the GDPR to impose fines and use the other corrective powers provided; stresses that bans on processing, or the obligation to delete personal data acquired in a manner

PE663.032v02-00 32/88 AM\1223869EN.docx

EN

that is not compliant with the GDPR, may have an equally if not higher deterrent effect than fines.

Or. en

Amendment 61Axel Voss, Henna Virkkunen, Kris Peeters, Daniel Caspary, Jeroen Lenaers, Pascal Arimont, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



10. Notes that since the start of application of the GDPR, though some significant fines have been issued for cases of serious breaches, the possibilities of the GDPR in this regard have by far not been used to their full extent with discrepancies in the severity of sanctions applied across the Member States;

10. Takes note that 785 administrative fines were imposed for different infringements during the first 18 months of GDPR application but highlights that the level of fines significantly differs between Member States; considers particularly the level of fines imposed on some multinational companies to be too low to serve as an effective deterrent and to incentivise more privacy-friendly processing;

Or. en




10. Notes that since the start of application of the GDPR, though some significant fines have been issued for cases of serious breaches, the possibilities of the GDPR in this regard have by far not been used to their full extent with discrepancies in the severity of sanctions applied across

10. Notes that since the start of application of the GDPR, though some significant fines have been issued for cases of serious breaches, the possibilities of the GDPR in this regard have by far not been used to their full extent with discrepancies in the severity of sanctions applied across

AM\1223869EN.docx 33/88 PE663.032v02-00

EN

the Member States; the Member States; calls on the supervisory authorities to use the full range of possibilities particularly in case of systematic and persistent breaches with gainful interest and with a large number of affected data subjects;

Or. en

Amendment 63Axel Voss, Roberta Metsola, Henna Virkkunen, Kris Peeters, Daniel Caspary, Jeroen Lenaers, Pascal Arimont, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



10 a. Calls upon the European Commission and the EDPB to harmonise penalties by bringing forward Guidelines and clear criteria in order to increase legal certainty and to prevent companies settling in locations that impose the lowest penalties;

Or. en




10 a. Welcomes that the conference of German supervisory authorities has developed a set of criteria for establishing the size of administrative fines pursuant to Article 83; calls on the EDPB to develop such a set of criteria on the European level;

PE663.032v02-00 34/88 AM\1223869EN.docx

EN

Or. en




10 b. Reminds that in addition, or as an alternative to issuing fines, supervisory authorities can and should also use their power to impose a temporary or definitive limitation including a ban on processing;

Or. en




11. Is concerned with the length of investigation of cases by some DPAs and its adverse effect on the effective enforcement and on citizens’ trust; urges DPAs to speed up resolution of cases and use all mechanisms available to them under the GDPR, including resorting to temporary or definitive limitations or a ban on processing;

11. Is concerned with the length of investigation of cases by some DPAs and its adverse effect on the effective enforcement and on citizens’ trust; urges DPAs to speed up resolution of cases and use all mechanisms available to them under the GDPR, including resorting to temporary or definitive limitations or a ban on processing and to the urgency procedure provided for under Article 66 GDPR;

Or. en

Amendment 67

AM\1223869EN.docx 35/88 PE663.032v02-00

EN

Sophia in 't Veld, Michal Šimečka, Nathalie Loiseau, Moritz Körner



11. Is concerned with the length of investigation of cases by some DPAs and its adverse effect on the effective enforcement and on citizens’ trust; urges DPAs to speed up resolution of cases and use all mechanisms available to them under the GDPR, including resorting to temporary or definitive limitations or a ban on processing;

11. Is concerned with the length of investigation of cases by some DPAs, particularly the Irish and Luxemburgish DPAs, and its adverse effect on the effective enforcement and on citizens’ trust; urges DPAs to speed up resolution of cases and use all mechanisms available to them under the GDPR, including resorting to temporary or definitive limitations or a ban on processing;

Or. en




11 a. Expresses its concern that slow or even non-existent enforcement of the GDPR prolongs the "business as usual" situation under Directive 95/46/EC, where data protection law was generally neglected;

Or. en



PE663.032v02-00 36/88 AM\1223869EN.docx

EN


12. Deplores that DPAs of 21 Member States have explicitly stated that they do not have sufficient human, technical and financial resources to effectively perform their tasks and exercise their power; urges the European Commission to take appropriate measures, including by starting infringement procedures without delay against those Member States that have failed to fulfil this obligation;

12. Calls upon Member States to comply with their legal obligation to allow the proper enforcement of the GDPR rules across the Union by allocating greater funds to their DPAs in order to allow them to carry out their work in the best way possible and to ensure a European level playing field in the enforcement of the GDPR; notes that each DPA across Europe should have a sufficient and adequate level of human, technical, financial resources, premises and infrastructure; urges the European Commission to take appropriate measures, including by starting infringement procedures without delay against those Member States that have failed to fulfil this obligation;

Or. en





12. Deplores that the supervisory authorities of 21 states out of the combined 30 states of the European Union, Norway, Iceland, and the UK have explicitly stated that they do not have sufficient human, technical and financial resources to effectively perform their tasks and exercise their power; is concerned by the lack of dedicated technical staffs in most supervisory authorities across the EU which makes investigations and enforcement difficult; urges the European Commission to take appropriate measures, including by starting infringement procedures without delay against those

AM\1223869EN.docx 37/88 PE663.032v02-00

EN

Member States that have failed to fulfil this obligation;

Or. en

Amendment 71Sophia in 't Veld, Moritz Körner, Michal Šimečka, Nathalie Loiseau




12. Deplores that DPAs of 21 Member States have explicitly stated that they do not have sufficient human, technical and financial resources to effectively perform their tasks and exercise their power; deplores that these Member States are in breach of Article 52(4) of the GDPR; regrets that the European Commission has not yet started infringement procedures against those Member States that have failed to fulfil this obligation; urges the Commission to start infringement procedures without delay;

Or. en




12. Deplores that DPAs of 21 Member States have explicitly stated that they do not have sufficient human, technical and financial resources to effectively perform their tasks and exercise their power; urges the European Commission to take appropriate measures, including by starting infringement procedures without

12. Is concerned that DPAs of 21 Member States have explicitly stated that they do not have sufficient human, technical and financial resources to effectively perform their tasks and exercise their power; urges the European Commission to take appropriate measures;

PE663.032v02-00 38/88 AM\1223869EN.docx

EN

delay against those Member States that have failed to fulfil this obligation;

Or. en

Amendment 73Jeroen Lenaers



12 a. Notes with concern that supervisory authorities in the Member States are under strain given the growing mismatch between their responsibilities to protect personal data and their resources to do so; notes that digital services will become increasingly complex due to the increased use of innovations like artificial intelligence; points therefore to the importance of EU supervisory authorities being adequately resourced and staffed in order to properly monitor the application of the GDPR and protect fundamental rights and freedoms; calls on the Commission to evaluate the possibility of obliging large multinational tech companies to pay for their own oversight through the introduction of an EU digital.

Or. en




12 a. Expresses its concern that insufficient resources for data protection authorities, in particular when these

AM\1223869EN.docx 39/88 PE663.032v02-00

EN

resources are compared with big tech companies' revenue, may result in agreements on settlements, as this would limit the cost of lengthy and cumbersome proceedings;

Or. en




12 a. Observes the increasing limited transparency on data processing, especially for algorithmic training, making oversight and enforcement by DPAs more difficult; calls on the EDPB to issue guidance on improved transparency requirements;

Or. en




12 b. Notes with concern that the lack of enforcement by data protection authorities, and the inaction on part of the Commission to address the lack of resources of the data protection authorities, leaves the burden of enforcement on individual citizens to bring data protection claims to court; expresses its concern that courts might not have the expertise to handle technical data protection issues in the same way as

PE663.032v02-00 40/88 AM\1223869EN.docx

EN

data protection authorities, and that individual claimants are compensated while the organisation or company is not ordered to solve structural problems; considers that private enforcement can trigger important case law, but does not constitute a replacement for enforcement by the data protection authorities or action by the Commission to address the lack of resources.

Or. en

Amendment 77Axel Voss, Roberta Metsola, Henna Virkkunen, Kris Peeters, Eva Maydell, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



13. Regrets that, as regards collective redress, the majority of Member States decided not to implement Article 80(2) of GDPR ; calls on all Member States to make use of Article 80(2);

13. Requests the introduction of clear material thresholds (such as professional secrecy, suspected criminal offences, credit card accounts or passwords) for confirming a notifiable personal data breach; notes that a European standard data breach notification form, with English as second language, is necessary to harmonise the diverse national approaches; calls for additional guidance by the EDPB in order to specify the timeline for notifications as well as for setting up common standards on how to inform individuals and on how to make remediation;

Or. en



AM\1223869EN.docx 41/88 PE663.032v02-00

EN

Paragraph 13



13. Regrets that, as regards collective redress, the majority of Member States decided not to implement Article 80(2) of GDPR ; calls on all Member States to make use of Article 80(2); calls on the Commission to establish and maintain a list of organisations per Member State which are considered eligible to represent data subjects in accordance with Article 80(2);

Or. en





13. Regrets that, as regards collective redress, the majority of Member States decided not to implement Article 80(2) of GDPR ; calls on all Member States to make use of Article 80(2) and provide the right to lodge complaints and to go to court without being mandated by a data subject;

Or. en




PE663.032v02-00 42/88 AM\1223869EN.docx

EN

13 a. Calls the Commission and the EDPB to organise a follow-up of the Communication of the Commission of 20 June 2020; calls for a study identifying the shortcomings of the GDPR when it comes to enforcement; calls for a comparison of the enforcement of the GDPR by each supervisory authority, including the collection of information in this regard from the supervisory authorities via the EDPB; calls for the organisation of a hearing by the LIBE committee where the supervisory authorities and the EDPB could be heard on the difference of enforcement observed between the Member States ;

Or. en




13 a. Calls on Member States to clarify the position of complainants during proceedings in national administrative procedures legislation applicable to supervisory authorities; points out that this should clarify that complainants are not limited to a passive role during the procedure, but should be able to intervene at different stages;

Or. en



AM\1223869EN.docx 43/88 PE663.032v02-00

EN


13 a. Deplores that data protection authorities in 14 Member States are not properly equipped to contribute to the cooperation and consistency mechanism; points out that the success of this 'one stop shop mechanism' depends on the time and effort that DPAs can dedicate to the handling of and cooperation on individual cross-border cases in the EDPB, and that the lack of resources has immediate consequences for the extent to which this mechanism can function properly;

Or. en




13 a. Points out that some companies are exploiting the fact that some third countries do not have a high level of data protection to train their AI or to test their new data driven business models without any restrictions to advance in technical terms and eventually capture market shares in Europe;

Or. en



PE663.032v02-00 44/88 AM\1223869EN.docx

EN


13 b. Calls on all Member States to establish specific support for data subjects, or organisations representing them, involved in cross-border complaints; points out that in case of cross-border complaints, procedural costs quickly become obstacles to the efficient exercise of data subjects’ rights; calls on Member States to limit such costs under their national administrative procedures laws and to enable access to legal advice under the law of another Member State;

Or. en




13 c. Calls the Commission and the EDPB to organise a follow-up to the Communication of the Commission of 20 June 2020; instructs its research service to prepare a study identifying the shortcomings of the GDPR when it comes to enforcement; in that study requests a comparison of the enforcement of the GDPR by each supervisory authority, including the collection of information in this regard from the supervisory authorities via the EDPB; calls for the organisation of a hearing by the LIBE committee where the study is presented, and where the supervisory authorities and the EDPB will be heard on the difference of enforcement observed between the Member States;

Or. en

AM\1223869EN.docx 45/88 PE663.032v02-00

EN

Amendment 86Axel Voss, Roberta Metsola, Henna Virkkunen, Kris Peeters, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



14. Points out that the weak enforcement is particularly evident in cross-border complaints, i.e. cooperation and consistency mechanisms; calls on the EDPB to increase its efforts to ensure the correct application of Articles 60 and 63 GDPR and to make use of the urgency procedure of Article 66 GDPR;

14. Underlines the importance of the one-stop-shop mechanism in providing legal certainty and reducing the administrative burden for companies and citizens alike; points out that each DPA in a cross-border investigation must follow the requirements and guidelines of the Lead Supervisory Authority and stick to the procedures outlined in Art 56 - 60 GDPR;

Or. en

Amendment 87Birgit Sippel




14. Points out that the weak enforcement is particularly evident in cross-border complaints, i.e. cooperation and consistency mechanisms; calls on the EDPB to increase its efforts to ensure the correct application of Articles 60 and on the 63 GDPR; and calls on the supervisory authorities to make use of the urgency procedure of Article 66 GDPR, in particular of the provisional measures where needed;”

Or. en

PE663.032v02-00 46/88 AM\1223869EN.docx

EN





14. Points out that the weak enforcement is particularly evident in cross-border complaints, i.e. cooperation and consistency mechanisms; calls on the EDPB to increase its efforts to ensure the correct application of Articles 60 and 63 GDPR and on the supervisory authorities to make use of the urgency procedure of Article 66 GDPR, in particular the provisional measures where needed;

Or. en





14. Points out that the weak enforcement is particularly evident in cross-border complaints, i.e. cooperation and consistency mechanisms; calls on the EDPB to increase its efforts to ensure the correct application of Articles 60 and 63 GDPR and on supervisory authorities to make use of the urgency procedure of Article 66 GDPR, in particular the provisional measures where needed;

Or. en


AM\1223869EN.docx 47/88 PE663.032v02-00

EN




14. Points out that the weak enforcement is particularly evident in cross-border complaints, i.e. cooperation and consistency mechanisms; calls on the EDPB to increase its efforts to ensure the correct application of Articles 60 and 63 GDPR and on supervisory authorities to make use of the urgency procedure of Article 66 GDPR, in particular the provisional measures where needed;

Or. en




14 a. Expresses great concerns over the functioning of the "one stop shop" mechanism, particularly regarding the role of the Irish data protection authority; notes that the Irish data protection authority is responsible for handling a large number of cases because many tech companies have registered their EU headquarters in Ireland; is concerned that the Irish data protection authority closes by far most cases with a settlement instead of a sanction; calls on the Irish data protection authority to speed up its ongoing investigations into major cases in order to show EU citizens that data protection is an enforceable right in the EU;

Or. en

PE663.032v02-00 48/88 AM\1223869EN.docx

EN

Amendment 92Sophia in 't Veld, Michal Šimečka, Nathalie Loiseau, Moritz Körner, Olivier Chastel



14 a. Expresses great concerns over the functioning of the one stop shop mechanism, particularly regarding the role of the Irish and Luxemburgish data protection authorities; notes that these data protection authorities are responsible for handling a large number of cases because many tech companies have registered their EU headquarters in Ireland or Luxemburg; calls on the Irish and Luxemburgish data protection authorities to speed up their ongoing investigations into major cases in order to show EU citizens that data protection is an enforceable right in the EU;

Or. en

Amendment 93Axel Voss, Henna Virkkunen, Kris Peeters, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



14 a. Calls for a better use of the mechanism under which any DPA, the EDPB Chair or the European Commission can request that a matter of general application or with effects to more than one Member State is examined by the EDPB in order to get an assessment of cases, in which competent DPAs fail to comply with the obligations under Art 61 or 62 GDPR;

AM\1223869EN.docx 49/88 PE663.032v02-00

EN

Or. en




14 b. Is strongly concerned about the fact that cases referred to Ireland in 2018 due to the main establishment of several major data controllers being there have not even reached the stage of a draft decision pursuant to Article 60(3); strongly disagrees that “without delay” pursuant to Article 60(3) could be understood as “more than two years later” in Irish English; calls on the Commission to start infringement procedures against Ireland;

Or. en

Amendment 95Sophia in 't Veld



14 b. Urges the European Commission to assess whether national administrative procedures hinder the full effectiveness of the cooperation mechanism and to fulfil its duty by taking action, including infringement procedures where necessary, in case such national procedures impede the effective implementation of the cooperation mechanism as per the GDPR;

Or. en

PE663.032v02-00 50/88 AM\1223869EN.docx

EN




15. Observes inconsistencies between the national guidance and the EDPB guidelines;

15. Highlights that the guidelines by the EDPB, national or even local DPAs regularly lay out different approaches and interpretations of the GDPR, resulting in different applications among Member States; notes that this situation is creating geographical advantages as well as disadvantages for companies and therefore stresses the importance of a consistent interpretation of the GDPR to provide legal certainty;

Or. en




15. Observes inconsistencies between the national guidance and the EDPB guidelines;

15. Observes inconsistencies between the national guidance and the EDPB guidelines; calls on the DPAs to strive for consistent guidance with the assistance of the EDPB.

Or. en


AM\1223869EN.docx 51/88 PE663.032v02-00

EN



15 a. Calls on the EDPB to establish basic elements of a common administrative procedure to handle complaints in cross-border cases under the cooperation mechanism of Article 60; urges that this should be done by guidance on common timelines for carrying out investigations and adopting decisions; urges the EDPB to provide a uniform interpretation of key GDPR terms such as “without delay”, “amicable settlements” and “decision’’;

Or. en




15 a. Calls on the European Commission as well as the EDPB to strengthen the consistency mechanism and making it mandatory for any matter of general application or for any case with cross-border effects in order to avoid inconsistent approaches and decisions from individual DPAs that threaten the uniform interpretation and application of the GDPR;

Or. en

Amendment 100

PE663.032v02-00 52/88 AM\1223869EN.docx

EN

Patrick Breyeron behalf of the Greens/EFA Group



15 b. Calls on the EDPB to publish its meeting agenda ahead of its meetings and to provide more detailed summary of meetings to the public and to the European Parliament;

Or. en




16 a. Considers it essential that the EDPB has sufficient financial, technical and human resources in order to be able to deal swiftly but thoroughly with an increasing number of resource-intensive and complex cases and to coordinate and facilitate cooperation between the national data protection authorities, as to provide an equal level playing field for companies and equal protection of citizens in the Union.

Or. en



AM\1223869EN.docx 53/88 PE663.032v02-00

EN


17. Observes a degree of fragmentation, which is notably due to the extensive use of facultative specification clauses; expresses concern that GDPR protections are being undermined by the way that Member States have implemented these specifications derogations (e.g. age of children to consent);

17. Deplores that the use by Member States of the large number of opening clauses has been detrimental to the achievement of full data protection harmonisation across the EU, the acceleration of data sharing and the elimination of diverging market conditions for companies across the EU; notes that it is often not the GDPR that restricts data sharing but the stricter Member State rules that deviate from the GDPR; highlights that for instance Member States have adopted very different thresholds for the parental consent principle;

Or. en





17. Observes a degree of fragmentation, which is notably due to the extensive use of facultative specification clauses; expresses concern that GDPR protections are being undermined by the way that Member States have implemented these specifications derogations (e.g. age of children to consent); calls on the Commission to use its powers to intervene in Member States where national measures, actions and decisions undermine the spirit, objective, and text of the GDPR, with a view to preventing unequal protection for citizens and market distortions.

Or. en

PE663.032v02-00 54/88 AM\1223869EN.docx

EN





17. Observes a degree of fragmentation, which is notably due to the use of facultative specification clauses, such as age of children to consent; expresses concern that this drives up the cost of GDPR-compliance; furthermore, stresses the need for the European Commission and Member States to assess the impact of this fragmentation with regard to child safety and protection online and the access to vital services for minors;

Or. en





17. Observes a degree of fragmentation, which is notably due to the extensive use of facultative specification clauses; expresses concern that GDPR protections are being undermined by the way that Member States have implemented these specifications (e.g. processing in the public interest or by public authorities based on Member State law);

Or. en

Amendment 106

AM\1223869EN.docx 55/88 PE663.032v02-00

EN

Patrick Breyeron behalf of the Greens/EFA Group



17 a. Expresses strong concerns over abuse of the GDPR by data protection authorities in Romania, Slovakia, Hungary and Poland to curtail journalists and NGOs; strongly agrees with the Commission that data protection rules should not affect the exercise of freedom of expression and information especially by creating a chilling effect or by being interpreted as a way to put pressure on journalists to disclose their sources; expresses however its disappointment over the fact that the Commission has still not finished its assessment of the balancing between the right to the protection of personal data with freedom of expression and information (Article 85); calls on the Commission to finish its assessment of national legislation in this respect without undue delay and use all available tools, including infringement procedures, to ensure that Member States comply with the GDPR and to limit any fragmentation of the data protection framework;

Or. en




17 a. Regrets that currently companies in cases of conflicts of laws have to decide whether they comply with national law of

PE663.032v02-00 56/88 AM\1223869EN.docx

EN

the Member State – thereby possibly infringing EU law – or if they observe the requirements of the GDPR - thereby possibly infringing the national law of the Member State;

Or. en




17 a. Insists that the GDPR should not be abused to curtail press freedom; calls on the Commission to launch infringement procedures where these abuses occur;

Or. en

Amendment 109Sophia in 't Veld, Michal Šimečka, Moritz Körner



Abuse of GDPR

Or. en

Amendment 110Sophia in 't Veld, Michal Šimečka, Nathalie Loiseau, Moritz Körner, Olivier Chastel, Ramona Strugariu


AM\1223869EN.docx 57/88 PE663.032v02-00

EN


17 a. Expresses strong concerns over abuse of the GDPR by data protection authorities in Romania, Slovakia, Hungary and Poland to curtail journalists and NGOs; strongly agrees with the Commission that data protection rules should not affect the exercise of freedom of expression and information especially by creating a chilling effect or by being interpreted as a way to put pressure on journalists to disclose their sources; expresses however its disappointment over the fact that the Commission has still not finished its assessment of the balancing between the right to the protection of personal data with freedom of expression and information (Article 85); calls on the Commission to finish its assessment of national legislation in this respect without undue delay and use all available tools, including infringement procedures, to ensure that Member States comply with the GDPR and to limit any fragmentation of the data protection framework;

Or. en




17 b. Calls on Slovakia to urgently nominate a new permanent head of the supervisory authority, as Soňa Pőtheová was removed from office in April 2020 for abusing her powers;

Or. en

PE663.032v02-00 58/88 AM\1223869EN.docx

EN

Amendment 112Axel Voss, Henna Virkkunen, Kris Peeters, Eva Maydell, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz



17 b. Calls upon the EDPB to bring forward guidance on how to deal with the different implementation of opening clauses between Member States;

Or. en




17 c. finds it unacceptable that Hungary has restricted certain data subjects rights by decree on 4th May 2020, under the disguise of the Covid-19 pandemic;

Or. en




17 d. Calls on the Commission to launch an infringement procedure against Germany for not awarding full enforcement power over

AM\1223869EN.docx 59/88 PE663.032v02-00

EN

telecommunications providers to the Federal Data Protection Commissioner;

Or. en




18. Calls on the supervisory authorities to evaluate the implementation of Article 25 on data protection by design and by default, in particular with a view to implement the principles of data minimisation and purpose limitation, in line with EDPB guidelines;

18. Calls on the supervisory authorities to evaluate the implementation of Article 25 on data protection by design and by default, in particular with a view to technical and operational measures to implement the principles of data minimisation and purpose limitation, and the effect this provision has so far on manufacturers of processing technologies; calls on the supervisory authorities to also assess the proper use of default settings as provided for in Article 25(2), including by major online service providers;

Or. en

Amendment 116Axel Voss, Henna Virkkunen, Kris Peeters, Eva Maydell, Daniel Caspary, Jeroen Lenaers, Pascal Arimont, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



18. Calls on the supervisory authorities to evaluate the implementation of Article 25 on data protection by design and by default, in particular with a view to

18. Calls on the supervisory authorities to evaluate the implementation of Article 25 on data protection by design and by default, in particular with a view to

PE663.032v02-00 60/88 AM\1223869EN.docx

EN

implement the principles of data minimisation and purpose limitation, in line with EDPB guidelines;

implement the principles of data minimisation and purpose limitation, in line with EDPB guidelines; notes in this regard that it is still unclear what ‘privacy by design’ means in practice and therefore asks the EDPB for more guidance as well as a list of clear criteria;

Or. en




18 a. Recommends that the EDPB adopts guidelines to determine under which specific conditions and in which (classes of) cases, ICT manufacturers are to be considered controllers pursuant to Article 4(7) GDPR, in that they determine the means of processing;

Or. en




18 b. Points out that data protection practices still largely depend on manual tasks and arbitrary formats, and are riddled with incompatible systems; calls on the EDPB to develop findable, accessible, interoperable and reusable standards that help to implement data

AM\1223869EN.docx 61/88 PE663.032v02-00

EN

protection requirements into practice, including standards for data protection impact assessments (Article 35), data protection by design and by default (Article 25), information directed at data subjects (Articles 12–14), the exercise of data subjects' rights (Articles 15–18, 20–21), and records of processing activities (Article 30); calls on the EDPB to also have such standards machine-readable in order to allow for machine-to-machine communication between data subjects, controllers and data protection authorities (automating data protection);

Or. en




18 c. Calls on the Commission to develop the machine-readable icons pursuant to Article 12(7) for informing data subjects, in close coordination with the EDPB;

Or. en




18 d. Encourages the EDBP and the supervisory authorities to leverage the full

PE663.032v02-00 62/88 AM\1223869EN.docx

EN

potential of Art. 21 (5) on automated ways to object to the processing of personal data;

Or. en




19. Calls on the EDPB to develop standards and guidelines that help to implement data protection requirements into practice, i.a. for data protection impact assessments (Article 35), information to data subjects (Articles 12–14), the exercise of data subjects' rights (Articles 15–18, 20–21), and records of processing activities (Article 30);

19. Calls on the EDPB to harmonise and develop standards and guidelines that help to implement data protection requirements into practice, i.a. the risk-based approach, information to data subjects (Articles 12–14), the exercise of data subjects' rights (Articles 15–18, 20–21), joint-controllers (Art 26), records of processing activities (Article 30), breach notifications (Art 33) and data protection impact assessments (Article 35);

Or. en

Amendment 122Axel Voss, Henna Virkkunen, Kris Peeters, Eva Maydell, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



19 a. Calls on the EDPB to critical asses its own role and the impact of its guidelines on industries and the data economy as a whole by identifying areas where its interpretation goes beyond the GDPR text and the will of the legislator; encourage the EDPB to also fulfil the task

AM\1223869EN.docx 63/88 PE663.032v02-00

EN

of a service provider that enables innovation across Europe;

Or. en




19 b. Encourages the EDPB to clarify data processing for human resources purposes and to bring forward guidance in cases employees and applicants are making data subject requests as the GDPR does not cover this area very well; calls upon the EDPB to also reconsider its reading of Art 30(5) GDPR and no longer interpret salary payments as ‘occasional’ data processing;

Or. en




19 c. Takes note of the conclusion of the EDPB that the risk-based approach enshrined in the GDPR should be maintained; calls for the complementation of the EDPB with a board of stakeholders from research, industry, users and consumer organisations, religious associations and civil society organisations;

PE663.032v02-00 64/88 AM\1223869EN.docx

EN

Or. en




20. Stresses the importance to allow free personal data flows at international level without lowering the level of protection guaranteed under the GPDR; supports the practice of the European Commission to address data protection and personal data flows separately from trade agreements;

20. Stresses the importance to allow free personal data flows at international level without lowering the level of protection guaranteed under the GPDR; supports the practice of the European Commission to address data protection and personal data flows separately from trade agreements; welcomes the adequacy decision for data flows with Japan; calls on the Commission to take all issues raised by Parliament into account in the first review on the adequacy of the protection of personal data afforded by Japan, and make the results publicly available as soon as possible.

Or. en




20 a. Regrets that to date it has been impossible to set up a sustainable single mechanism that guarantees the secure transmission of personal data between the EU and the US; calls on the Commission to negotiate and conclude a data sharing agreement between the EU and the US that provides a reliable and long-lasting legal framework which addresses

AM\1223869EN.docx 65/88 PE663.032v02-00

EN

existing concerns in this area, as a matter of priority

Or. en

Amendment 127Axel Voss, Henna Virkkunen, Kris Peeters, Eva Maydell, Javier Zarzalejos, Roberta Metsola, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



20 a. Believes that international cooperation in the field of data protection and the convergence of relevant rules will improve mutual trust, foster understanding of technological and legal challenges, and eventually facilitate cross-border data flows which are of key importance for international trade;

Or. en




21. Stresses that adequacy decisions should not be political but legal decisions;

21. Stresses that adequacy decisions should not be political but legal decisions; acknowledges, however, the reality of conflicting legal requirements for companies operating legally sound activities in the EU, as well as in third country jurisdictions, notably the US; acknowledges furthermore that data localisation may not prevent the transfer of personal data from EU citizens to the US government, if this is required under

PE663.032v02-00 66/88 AM\1223869EN.docx

EN

US law; insists therefore, on the need to find legally sound solutions at political level;

Or. en

Amendment 129Axel Voss, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Eva Maydell, Roberta Metsola, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima




21. Welcomes the European Commission’s work on privacy adequacy decisions and encourages continued efforts to promote global legal frameworks to enable data transfers; takes also note that stakeholders continue to consider adequacy decisions an essential tool for such data flows since they do not attach them to additional conditions or authorisations;

Or. en





21. Stresses that adequacy decisions should not be political but legal decisions; regrets that the Commission tends to put considerations of diplomatic relations with third countries over compliance and enforcement of the GDPR, despite repeated calls from Parliament and experts about concerns in case of the EU-

AM\1223869EN.docx 67/88 PE663.032v02-00

EN

US Privacy Shield;

Or. en

Amendment 131Axel Voss, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Eva Maydell, Roberta Metsola, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



21 a. Welcomes the adoption of the first mutual adequacy decision between the EU and Japan, which has created the largest area of free and safe data flows in the world; emphasises however that so far adequacy decisions have only been adopted for nine countries even though many additional third countries have recently adopted new data protection laws with similar rules and principles as the GDPR; stresses in this regard that adequacy decisions should not be political but legal decisions;

Or. en

Amendment 132Axel Voss, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Eva Maydell, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



22. Calls on the European Commission to publish the set of criteria used in determining whether a third country is deemed to provide an “essentially equivalent” level of protection to that

22. Calls on the European Commission to publish the set of criteria used in determining whether a third country is deemed to provide an “essentially equivalent” level of protection to that

PE663.032v02-00 68/88 AM\1223869EN.docx

EN

afforded in the EU especially with regards to access to remedies, and government access to data;

afforded in the EU;

Or. en




23. Reiterates that mass surveillance programmes that encompass bulk data collection prevents adequacy findings;

deleted

Or. en

Amendment 134Axel Voss, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Eva Maydell, Javier Zarzalejos, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima




23. Takes note of the invalidation of the EU-US Privacy Shield by the CJEU ruling from July 2020; stresses that it puts many European SMEs, start-ups, universities and research institutes which had relied on the mechanism in legal limbo; calls on the Commission to engage in discussions with its US counterparts in order to find as soon as possible a viable solution for commercial personal data transfers between the EU and the US that fully respects the conditions set by the CJEU;

Or. en

AM\1223869EN.docx 69/88 PE663.032v02-00

EN





23. Reiterates that mass surveillance programmes that encompass bulk data collection prevent adequacy findings; urges the Commission to apply the conclusions of the CJEU in the cases Schrems I, II and Privacy International & al (2020) to all reviews of adequacy decisions as well as ongoing and future negotiations;

Or. en




24. Calls on the DPAs to systematically assess whether data protection rules are applied in practice in third countries, in line with the European Court of Justice case-law;

24. Calls on the European Commission to systematically assess whether data protection rules are applied in practice in third countries, in line with the European Court of Justice case-law;

Or. en



PE663.032v02-00 70/88 AM\1223869EN.docx

EN


25 a. Insists on the need to ensure the effective application of and compliance with the provisions related to transfers or disclosures not authorised by Union as per Article 48 GDPR, in particular regarding request by third countries authorities for access to personal data in the Union, and calls on the EDPB and DPAs to provide guidance and enforce these provisions, including in the assessment and development of personal data transfer mechanisms;

Or. en

Amendment 138Jeroen Lenaers



25 a. Calls upon the European Commission and the EDPB to develop guidance on codes of conduct; acknowledges that this tool is currently under used while it has the potential to create the legal certainty that many users are currently looking for; calls furthermore upon the European Commission and the EDPB to facilitate the creation of specific pan-European codes of conduct, where this is of added value;

Or. en


AM\1223869EN.docx 71/88 PE663.032v02-00

EN



25 a. Highlights that, in the absence of an adequacy decision, standard contractual clauses (SCC) are the most widely used tool for international data transfers; takes note that the ECJ in its judgment in case C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems in July 2020 upheld the validity of Decision1087/2010 on SCC;

Or. en

Amendment 140Axel Voss, Roberta Metsola, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Eva Maydell, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz



25 b. Welcomes the publication of draft SCCs by the European Commission and highlights the importance of including processor-to-processor as well as controller-processor clauses; welcomes also the objective to make SCCs more user-friendly and to address identified shortcomings of the current standards and underlines the need to include various SCCs on a number of issues that particularly SMEs find difficult to apply;

Or. en



PE663.032v02-00 72/88 AM\1223869EN.docx

EN

Paragraph 25 b (new)


25 b. Recalls that transfers relying on derogations for specific situation as per Article 49 GPDR shall remain exceptional and calls on the EDPB and DPA to maintain a strict interpretation in the application and control of such derogations;

Or. en

Amendment 142Axel Voss, Jörgen Warborn, Henna Virkkunen, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz



25 c. Considers the draft EDPB guidelines to be totally impractical and that they would render SCCs useless as a data transfer tool; notes that those proposals are also not in line with the GDPR’s risk-based approach or the CJEU judgement and stresses that the requirement of encryption of data at all moments outside of the EU is simply not feasible in practice; calls upon the EDPB to reconsider its draft guidelines as Europe is otherwise not able to transfer personal data internationally anymore;

Or. en

Amendment 143Axel Voss, Roberta Metsola, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz


AM\1223869EN.docx 73/88 PE663.032v02-00

EN


25 d. Calls upon the EDPB to bring forward guidance on the use of grace periods in cases when an existing adequacy decision was struck down or updated;

Or. en

Amendment 144Axel Voss, Roberta Metsola, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz



25 e. States furthermore that also transfer mechanisms such as Codes of Conduct, Binding Corporate Rules (BCRs) and certification mechanisms are good means to foster international data transfers while ensuring compliance with GDPR standards;

Or. en

Amendment 145Axel Voss, Jörgen Warborn, Henna Virkkunen, Daniel Caspary, Anna-Michelle Asimakopoulou, Ralf Seekatz



25 f. Calls upon the European Commission and the EDPB to develop guidance on codes of conduct and to facilitate a pan-European code of conduct, to better support SMEs, to foster legal certainty and to encourage the use

PE663.032v02-00 74/88 AM\1223869EN.docx

EN

of this instrument for the international transfer of data; notes that the requirement of a compulsory supervisor to oversee and enforce sectoral codes of conduct should be withdrawn;

Or. en




25 g. Underlines that the bar for the creation and implementation of BCRs as determined by the DPA’s Working Papers for BCRs is too strict and too narrow for digital matters;

Or. en

Amendment 147Axel Voss, Roberta Metsola, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Daniel Caspary, Jeroen Lenaers, Pascal Arimont, Anna-Michelle Asimakopoulou, Ralf Seekatz

Draft motion for a resolutionParagraph 25 h (new)


25 h. Calls upon the European Commission to develop together with the International Organisation for Standardisation a voluntary international certification mechanism and Audit scheme for companies - in particular for providers of software and cloud solutions - to boost the use of a certification mechanisms as a means for international data transfers;

AM\1223869EN.docx 75/88 PE663.032v02-00

EN

Or. en




26. Reminds the Commission of its obligation to ensure that measures to be presented in upcoming legislative proposals, in particular on data governance, data act, digital services act, artificial intelligence, must comply with the GDPR (EU) 2016/679 and Directive (EU) 2016/680;

26. Regrets that the Commission itself does not always have a coherent approach to data protection in legislative proposals, or lacks sufficient knowledge about data protection including GDPR requirements; stresses that a reference to the application of the GDPR, or 'without prejudice to the GDPR', without further explanation in the text, does not necessarily make the proposal GDPR compliant; reminds the Commission of its obligation to ensure that measures to be presented in upcoming legislative proposals, in particular on data governance, data act, digital services act, artificial intelligence, health data space, must always fully comply with the GDPR (EU) 2016/679 and Directive (EU) 2016/680; calls on the Commission to consult the EDPS and EDPB where necessary and possible prior to the presentation of the proposal, and always conduct a (data protection) impact assessment;

Or. en

Amendment 149Axel Voss, Roberta Metsola, Henna Virkkunen, Kris Peeters, Eva Maydell, Javier Zarzalejos, Daniel Caspary, Jeroen Lenaers, Pascal Arimont, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima


PE663.032v02-00 76/88 AM\1223869EN.docx

EN


26. Reminds the Commission of its obligation to ensure that measures to be presented in upcoming legislative proposals, in particular on data governance, data act, digital services act, artificial intelligence, must comply with the GDPR (EU) 2016/679 and Directive (EU) 2016/680;

26. Shares the view of the Commission by being technology-neutral, the GDPR provides a solid regulatory framework for emerging technologies; considers nonetheless that further efforts are needed to clarify the application of the GDPR principles to these emerging technologies, to assess whether legal gaps exist and align its text with the new developments to carefully consider the correlation of the GDPR with each new legislative initiative, to preserve its risk-based approach and eventually, to avoid any interfering with the enforcement mechanisms established by the GDPR;

Or. en

Amendment 150Axel Voss, Roberta Metsola, Jörgen Warborn, Henna Virkkunen, Kris Peeters, Javier Zarzalejos, Daniel Caspary, Jeroen Lenaers, Anna-Michelle Asimakopoulou, Ralf Seekatz, Isabel Wiseler-Lima



26 a. Calls on the European Commission in these regards to also address any obstacles that the GDPR may have unintentionally created to the development of innovative and emerging technologies such as blockchain, artificial intelligence, big data or the Internet of Things; underlines that some very useful technologies for our society were obstructed by the new GDPR rules, exploiting the full benefits was prevented or disproportionate adjustments were necessary; asks therefore the EDPB to come up with necessary clarifications on how those new technologies can nevertheless thrive;

AM\1223869EN.docx 77/88 PE663.032v02-00

EN

Or. en




26 a. Calls on the Commission to address broader issues of digitisation, such as monopoly situations and power imbalances through specific regulation, e.g. in the field of public procurement, competition law or media regulation, while not undermining the GDPR, but aiming for mutual enforcement;

Or. en




26 a. Notes that the Digital Single market is a key priority for the European Union in the coming years; notes that it is essential that the GDPR is implemented in such a way that it increases competitiveness, trust and confidence in the handling of data within the EU;

Or. en


PE663.032v02-00 78/88 AM\1223869EN.docx

EN



Law Enforcement Directive

Or. en

Amendment 154Sophia in 't Veld, Michal Šimečka, Moritz Körner, Olivier Chastel



26 a. Is concerned that data protection rules used for law enforcement purposes are vastly inadequate to keep up with newly created competences for law enforcement; calls therefore on the Commission to evaluate Directive (EU) 2016/680 earlier than foreseen in the Directive and make the review publicly available.

Or. en




26 b. Calls on the Commission to take computer aided data protection control and privacy-enhancing technologies into account for their strategies in the area of data markets, Gaia-X, Digitising of Industry and Smart Cities, urban security

AM\1223869EN.docx 79/88 PE663.032v02-00

EN

and resilience, and to continue to support research in this area;

Or. en




26 b. States that the creation of common European data spaces will only be a success if at the same time the EU is capable to resolve the problems with the GDPR’s implementation and divergent interpretations of it among the Member States;

Or. en




26 c. Points out that there are especially sensitive categories of personal data beyond the special categories of personal data defined in Article 9 of the GDPR, such as data on electronic communications, on the use of digital services or on personal electricity consumption; notes particularly that since the online activities of individuals allow for deep insights into their personality and make it possible to manipulate them,

PE663.032v02-00 80/88 AM\1223869EN.docx

EN

the collection and processing of personal data concerning the use of digital and other networked services should be limited to the extent strictly necessary in order to provide the service and to bill the users; calls on the Commission to propose strict sector-specific data protection legislation for sensitive categories of personal data where it has not yet done so;

Or. en




26 c. Recognises the increasing use of profiling and demands that profiling based on factors such as income, gender, geographic location and others do not lead to discrimination in price, service quality or the availability of offers;

Or. en




26 d. Demands the strict enforcement of GDPR in the processing and the commercial use of personal data generated by wearable devices and voice

AM\1223869EN.docx 81/88 PE663.032v02-00

EN

assistants (e.g. in case of personalized advertisements or insurance applications); notes that at the same time, it should be ensured that data can be used, in compliance with GDPR, for the training and development of algorithms; calls to empower consumers to take informed decisions on the privacy implications of using these new technologies and to ensure that they have easy-to-use options to delete their personal data as is foreseen in the GDPR;

Or. en




27. Expresses its deep concern about the lack of implementation of the ePrivacy Directive by Member States in view of the changes introduced by the GDPR; calls on the Commission to speed up its assessment and initiate infringement procedures against those Member States that failed to properly implement the ePrivacy Directive;

27. Expresses its deep concern about the lack of implementation of the ePrivacy Directive by Member States in view of the changes introduced by the GDPR; calls on the Commission to speed up its assessment and take appropriate and necessary steps against those Member States that failed to properly implement the ePrivacy Directive;

Or. en

Amendment 161Birgit Sippel



27 a. Is greatly concerned that the interplay between the GDPR and the ePrivacy directive will lead to a

PE663.032v02-00 82/88 AM\1223869EN.docx

EN

fragmented legal landscape in the EU, detrimental to both businesses and citizens; expresses its deep concern over the ongoing deadlock by Member States in Council on the ePrivacy Regulation which was proposed by the Commission in January 2017 and on which Parliament adopted its negotiation position in October 2017; calls on the Council to swiftly adapt a negotiation mandate on the ePrivacy Regulation so that co-legislators can finally start inter-institutional negotiations;

Or. en




27 a. Recalls the importance to upgrade the ePrivacy rules from 2002 and 2011 in order to improve protection of fundamental rights of citizens and legal certainty for companies, complementing the GDPR; regrets that the Council has still not managed to find a general position on the proposal for the ePrivacy Regulation since 2017; calls on the Council to find agreement as soon as possible, so that inter-institutional negotiations can start;

Or. en



AM\1223869EN.docx 83/88 PE663.032v02-00

EN


27 a. Reminds that since the start of application of the GDPR, its definition of “consent” also applies to the e-Privacy Directive; is concerned that many information society services still do not comply with this, including through the use of “dark patterns” and without providing real information on the purposes and scope of processing; condemns this as not respecting free consent as provided for in Article 7;

Or. en




27 a. Acknowledges the need to update the rules governing the confidentiality of communications, which date back to 2002; takes note that the proposed e-privacy regulation has now being blocked in the Council for four years and therefore, should be withdrawn by the Commission; underlines that specific provisions to ensure the confidentiality of communication should be included to the GDPR as a new chapter;

Or. en



PE663.032v02-00 84/88 AM\1223869EN.docx

EN

Paragraph 27 b (new)


27 b. Calls on the Council to use its best endeavours to complete its work on the ePrivacy Regulation, which was designed to complement and coincide with introduction of the GDPR, and for the timely convening of meetings with the other institutions to agree on a final text strongly aligned with what has already been resolved by the European Parliament, including the requirement that software providers ensure browsers and devices have built-in mechanisms for protecting personal data and the secure acquisition and signalling of freely given, specific and informed user consent or of objection, and end-to-end encryption without any backdoors; considers that any future third country data protection adequacy decision should require that importers of personal data respect such signals;

Or. en




27 b. Notes that the European Commission’s draft regulation as well as the European Parliament’s first reading position both failed the objective of aligning the old ePrivacy directive with the GDPR but would instead create a separate track of privacy law that would throw the whole EU privacy policy into contention; underlines that if not completely withdrawn, the new ePrivacy

AM\1223869EN.docx 85/88 PE663.032v02-00

EN

regulation must cover only matters that are not already addressed by the GDPR (e.g. confidentiality of communications);

Or. en

Amendment 167Axel Voss, Henna Virkkunen, Daniel Caspary, Jeroen Lenaers, Javier Zarzalejos, Anna-Michelle Asimakopoulou, Ralf Seekatz



27 c. Stresses that microtargeting nowadays uses over 1500 criteria for profiling, which leads to political manipulation and commercial lock-up-effects for consumers; proposes therefore to limit the criteria for political microtargeting to three criteria, whereas commercial microtargeting should only be allowed if there is also the possibility for the consumer to search outside of the existing profile as if there would not be any profile; notes that the latter rule should also apply to search engines that are using rankings based on financial contributions from commercial actors;

Or. en




SECTORAL ISSUES

Or. en

PE663.032v02-00 86/88 AM\1223869EN.docx

EN




27 d) Notes that the GDPR does not cover specific sectoral concerns, which led to a situation, in which the application of the GDPR still remains unclear; calls upon the EDPB to bring forward clear sectorial guidance for areas such as Health care and finances; points out that the use of codes of conduct could also help resolving the legal uncertainty;

Or. en




27 e) Notes that the right of users to request that their provided and stored data is being transferred directly from one data holder to another in real-time, as granted by the PSD2, is not fully functioning in practice yet; supports the European Commission in its view that the effective use of this right could be increased by mandating technical interfaces that would allow the portability of data in real-time;

Or. en

AM\1223869EN.docx 87/88 PE663.032v02-00

EN




27 f) Underlines the importance in times of COVID-19 of a secondary use of data in health care and thus, calls for a broader interpretation of consent that would allow other purposes than initially foreseen; underlines furthermore that the enhanced harmonisation in the field of personal data processing is critical for Research purposes;

Or. en




27 g) Emphasises that profit-seeking companies are also carrying out important scientific research; calls consequently for a broad understanding of the ‘scientific research’ provision as well as a consistent approach regarding the use of sensitive personal data;

Or. en



PE663.032v02-00 88/88 AM\1223869EN.docx

EN

Paragraph 27 h (new)


27 h) Calls upon the Commission to come up with a regime for health data to balance the protection of personal data while at the same time enabling European data spaces to train European AI, health research and to improve health services for its citizens;

Or. en

am com nonlegre · 2020. 12. 21. · am\1221158en.docx pe663.032v01-00 enunited in diversityen...

Documents