Sittings · Compare

What changed

From · agreement provisional · 2024-02-21 LIBE-AG-759687 Proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) 2021/1232 of the European Parliament and of the Council on a temporary derogation from certain provisions of Directive 2002/58/EC for the purpose of combating online child sexual abuse

→

To · Plenary report · 2024-02-01 A-9-2024-0021 on the proposal for a regulation of the European Parliament and of the Council Amending Regulation (EU) 2021/1232 of the European Parliament and of the Council on a temporary derogation from certain provisions of Directive 2002/58/EC for the purpose of combating online child sexual abuse

+240 added · −48 removed · 0 modified paragraphs hide unchanged text

~~21.2.2024~~

PR_COD_1amCom

~~PROVISIONAL AGREEMENT RESULTING FROM INTERINSTITUTIONAL NEGOTIATIONS~~

Symbols for procedures

Subject: Proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) 2021/1232 of the European Parliament and of the Council on a temporary derogation from certain provisions of Directive 2002/58/EC for the purpose of combating online child sexual abuse

* Consultation procedure

*** Consent procedure

***I Ordinary legislative procedure (first reading)

***II Ordinary legislative procedure (second reading)

***III Ordinary legislative procedure (third reading)

(The type of procedure depends on the legal basis proposed by the draft act.)

Amendments to a draft act

Amendments by Parliament set out in two columns

Deletions are indicated in bold italics in the left-hand column. Replacements are indicated in bold italics in both columns. New text is indicated in bold italics in the right-hand column.

The first and second lines of the header of each amendment identify the relevant part of the draft act under consideration. If an amendment pertains to an existing act that the draft act is seeking to amend, the amendment heading includes a third line identifying the existing act and a fourth line identifying the provision in that act that Parliament wishes to amend.

Amendments by Parliament in the form of a consolidated text

New text is highlighted in bold italics. Deletions are indicated using either the ▌symbol or strikeout. Replacements are indicated by highlighting the new text in bold italics and by deleting or striking out the text that has been replaced.

By way of exception, purely technical changes made by the drafting departments in preparing the final text are not highlighted.

DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

on the proposal for a regulation of the European Parliament and of the Council Amending Regulation (EU) 2021/1232 of the European Parliament and of the Council on a temporary derogation from certain provisions of Directive 2002/58/EC for the purpose of combating online child sexual abuse

(COM(2023)0777 – C90437/2023 – 2023/0452(COD))

The interinstitutional negotiations on the aforementioned proposal for a regulation have led to a compromise. In accordance with Rule 74(4) of the Rules of Procedure, the provisional agreement, reproduced below, is submitted as a whole to the Committee on Civil Liberties, Justice and Home Affairs for decision by way of a single vote.

(Ordinary legislative procedure: first reading)

~~2023/0452 (COD)~~

– having regard to the Commission proposal to Parliament and the Council (COM(2023)0777),

▌

– having regard to Article 294(2), Article 16(2) and Article 114(1) of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90437/2023),

~~REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL~~

– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

amending Regulation (EU) 2021/1232 of the European Parliament and of the Council on a temporary derogation from certain provisions of Directive 2002/58/EC for the purpose of combating online child sexual abuse

– having regard to the opinion of the European Economic and Social Committee (XXXX)

~~(Text with EEA relevance)~~

–– having regard to Rule 59 of its Rules of Procedure,

~~THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,~~

– having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A9-0021/2024),

~~Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16(2), in conjunction with Article 114(1), thereof,~~

– having regard to the Report from the European Commission on the implementation of Regulation (EU) 2021/1232 of the European Parliament and of the Council of 14 July 2021 on a temporary derogation from certain provisions of Directive 2002/58/EC as regards the use of technologies by providers of number- independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse (COM(2023) 797 final),

~~Having regard to the proposal from the European Commission,~~

1. Adopts its position at first reading hereinafter set out;

~~After transmission of the draft legislative act to the national parliaments,~~

2. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

~~Having regard to the opinion of the European Economic and Social Committee,~~

3. Instructs its President to forward its position to the Council, the Commission and the national parliaments.

~~Acting in accordance with the ordinary legislative procedure,~~

Amendment 1

~~Whereas:~~

Proposal for a regulation

(1) Regulation (EU) 2021/1232 of the European Parliament and of the Council provides for a temporary regime in respect of the use of technologies by certain providers of publicly available interpersonal communications services for the purpose of combating online child sexual abuse, pending the preparation and adoption of a long-term legal framework. That Regulation applies until 3 August 2024.

Recital -1 (new)

(2) The proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, which the Commission adopted on 11 May 2022, aims to provide that long-term legal framework. However, the inter-institutional negotiations on that proposal have not yet ▌ started and it is ▌ certain that they will not be concluded on time for the long-term legal framework, including any amendments to Regulation (EU) 2021/1232 that it may contain, to be adopted, to enter into force and to apply before 3 August 2024.

Text proposed by the Commission

(3) It is important that child sexual abuse online can be effectively combated, in accordance with the applicable rules of Union law, including the conditions set out in Regulation (EU) 2021/1232, without interruptions pending the conclusion of those inter-institutional negotiations and the adoption, entry into force and application of the long-term legal framework. The co-legislators express their commitment to reaching an agreement on the long-term legal framework as soon as possible, also with a view to avoiding any further extension of Regulation (EU) 2021/1232 in the future.

Amendment

(4) Therefore, given the particular circumstances, Regulation (EU) 2021/1232 should be amended to extend its period of application for ▌ a limited period of time strictly necessary to adopt the long-term legislation. It is crucial to note that this extension is exceptional and should not establish a precedent for future extensions. Regulation (EU) 2021/1232 was initially designed as a transitional, temporary instrument serving as a link between the implementation of Directive (EU) 2018/1972 of the European Parliament and the Council, which brought number-independent interpersonal communications services within the scope of Directive 2002/58/EC of the European Parliament and the Council starting on 21 December 2020, and the establishment of a long-term legal framework addressing the prevention and combatting of child sexual abuse online. Contrary to the co-legislators' expectation, the absence of an agreed long-term legal framework requires the extension of the application of Regulation (EU) 2021/1232.

(-1) In order to facilitate compliance with providers’ reporting obligations, in particular to ensure the machine-readability and easy accessibility of the reports, the publication format for the reports pursuant to Article 3(1)(f)(vii) of Regulation 2021/1232 should be harmonised.

(5) Considering the need to ensure, in a timely manner, legal certainty, as well as the limited nature of the amendment, namely the extension of the period of application of the existing regime, it is appropriate to provide that this Regulation enters into force as soon as possible.

Amendment 2

(5a) Pursuant to Regulation (EU) 2021/1232, in order for the temporary derogation from certain provisions of Directive 2002/58/EC to apply, the providers of number-independent interpersonal communications services have to publish and submit, to the competent supervisory authority and to the Commission, a report on the processing of personal data under Regulation (EU) 2021/1232.

Proposal for a regulation

(5b) In view of the Report from the Commission on the implementation of Regulation (EU) 2021/1232, it is necessary to improve the reporting to the Commission from both the Member States and the providers of number-independent interpersonal communication services. It is also important to stress that the Commission should report on the implementation of the Regulation (EU) 2021/1232 in due time.

Recital 1 a (new)

(5c) In order to facilitate the providers’ reporting, in particular to ensure the machine-readability and easy accessibility of their reports, a common publication format for those reports should be established.

Text proposed by the Commission

(5d) In order to ensure uniform conditions for the implementation of Regulation (EU) 2021/1232, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council.

Amendment

(5e) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council and delivered its opinion on 24 January 2024.

(1a) In order to ensure an adequate level of transparency and accountability, as well as to enable comprehensive and comparable reporting, it is necessary to lay down templates concerning the details of the reports that providers of number-independent interpersonal communications services should publish and submit to the competent supervisory authority and to the Commission on the processing of personal data under Regulation 2021/1232.

~~(5f) Regulation (EU) 2021/1232 should therefore be amended accordingly,~~

Amendment 3

~~HAVE ADOPTED THIS REGULATION:~~

Proposal for a regulation

~~Article -1b~~

Recital 1 b (new)

~~In Article 3(1)(g) of Regulation (EU) 2021/1232, a new subparagraph (viii) is inserted as follows:~~

Text proposed by the Commission

The data referred to in paragraph (1)(g)(vii) of this Article shall be provided in writing by means of a standard form. By 3 December 2024 at the latest, the Commission shall determine the content and presentation of that form by means of implementing acts. The Commission may decide to divide the data categories referred to in paragraph (1)(g)(vii) of this Article into subcategories. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 9a.

Amendment

~~Article -1c~~

(1b) In order to enable effective scrutiny over processing of personal data, providers of number-independent interpersonal communications services should use the template and the instructions laid out in the Annex to this Regulation when complying with their reporting obligations pursuant to Regulation (EU) 2021/1232.

~~In Article 9 of Regulation (EU) 2021/1232, the first paragraph is replaced by the following:~~

Amendment 4

On the basis of the reports submitted pursuant to Article 3(1), point (g)(vii), and the statistics provided pursuant to Article 8, the Commission shall, by 4 September 2025, prepare a report on the implementation of this Regulation and submit and present it to the European Parliament and to the Council.

Proposal for a regulation

~~Article -1d~~

Recital 1 c (new)

~~After Article 9 of Regulation (EU) 2021/1232, a new Article is inserted as follows:~~

Text proposed by the Commission

~~Article 9a Committee Procedure~~

Amendment

~~1. The Commission shall be assisted by a committee. That Committee shall be a Committee within the meaning of Regulation (EU) 182/2011.~~

(1c) In view of the Report from the Commission on the implementation of Regulation (EU) 2021/12321a, it is necessary to thoroughly improve the reporting mechanism to the European Commission from both the Member States and the providers of number-independent interpersonal communication services. It is also important to stress that the European Commission will be obliged to report on the implementation of the Regulation (EU) 2021/1232 in due time after the conclusion of the new period of application.

~~2. Where reference is made to this paragraph, Article 4 of Regulation (EU) 182/2011 shall apply.~~

1a REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the implementation of Regulation (EU) 2021/1232 of the European Parliament and of the Council of 14 July 2021 on a temporary derogation from certain provisions of Directive 2002/58/EC as regards the use of technologies by providers of number-independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse

~~Article 1~~

Amendment 5

~~In Article 10 of Regulation (EU) 2021/1232, the second ▌ paragraph is replaced by the following:~~

Proposal for a regulation

~~“It shall apply until 3 ▌ April 2026.”~~

Recital 2

~~Article 2~~

Text proposed by the Commission

~~This Regulation shall enter into force on the day following that of its publication in the Official Journal of the European Union.~~

Amendment

~~This Regulation shall be binding in its entirety and directly applicable in all Member States.~~

(2) The proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse10 aims to provide that long-term legal framework. However, the inter-institutional negotiations on that proposal have not yet been concluded and it is uncertain whether they will be concluded on time for the long-term legal framework, including any amendments to Regulation (EU) 2021/1232 that it may contain, to be adopted, to enter into force and to apply before 3 August 2024.

~~Done at Brussels,~~

(2) The proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse10, which the Commission adopted on 11 May 2022, aims to provide that long-term legal framework. The European Parliament adopted its position and the mandate to enter into inter-institutional negotiations on 22 November 2023 while the Council of the European Union has not reached a general approach yet. Consequently, it is certain that the legislative procedure will be not concluded before 3 August 2024.

~~For the European Parliament For the Council~~

10 Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, COM/2022/209 final.

~~The President The President~~

10 Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, COM/2022/209 final.

Amendment 6

Proposal for a regulation

Recital 3

Text proposed by the Commission

Amendment

(3) It is important that child sexual abuse online can be effectively combated which demonstrates the need for a permanent framework with a focus on preventive measures. Pending the conclusion of the legislative procedure and the adoption, entry into force and application of the long-term legal framework, a prolongation of Regulation (EU) 2021/1232 is only justified once and for a very limited period.

Amendment 7

Proposal for a regulation

Recital 4

Text proposed by the Commission

Amendment

(4) Therefore, Regulation (EU) 2021/1232 should be amended to extend its period of application for an additional period of time strictly necessary to adopt the long-term legislation.

(4) Therefore, given this extraordinary circumstances and the lack of progress with the permanent solution within the Council of the European Union, Regulation (EU) 2021/1232 should be amended to extend its period of application for a limited period of time strictly necessary to adopt the long-term legislation. It is crucial to note that this extension is exceptional and should not establish a precedent for future extensions. Regulation (EU) 2021/1232 was initially designed as a transitional, temporary instrument serving as a link between the implementation of Directive (EU) 2018/1972, which brought number-independent interpersonal communications services within the scope of Directive 2002/58/EC starting on 21 December 2020, and the establishment of a permanent Regulation addressing the prevention and combatting of child sexual abuse online. Contrary to the co-legislators expectation, the absence of an agreed permanent Regulation requires the extension of the application of Regulation (EU) 2021/1232. However, this extension must not be prolonged any further, with a clear stipulation that it should not undergo a second prolongation, emphasising the unique nature of this circumstance.

Amendment 8

Proposal for a regulation

Article -1 (new)

Regulation (EU) 2021/1232

Article 2 – point 3

Text proposed by the Commission

Amendment

Article -1

In Article 2, the third paragraph is deleted.

(32021R1232)

Amendment 9

Proposal for a regulation

Article -1 a (new)

Regulation (EU) 2021/1232

Text proposed by the Commission

Amendment

Article -1a

Template for the reporting

1. To ensure that the reports are machine-readable, providers shall publish the report in a CSV (comma-separated values) format. The Commission shall make available online the CSV- and XLSX-versions of the template in Annex I.

2. For providers of number-independent interpersonal communications services, the first reporting cycle following the full entry into application date of Regulation (EU) 20XX/XX on 04 August 2024 shall cover the period from 1 January 2024 until 31 December 2024. In case the period from 1 January until 04 August 2024 does not follow the template set out in Annex I to this Regulation, it shall be included in a separate section of the next report.

Amendment 10

Proposal for a regulation

Article 1 – paragraph 1

Regulation (EU) 2021/1232

Article 10 – paragraph 2

Text proposed by the Commission

Amendment

It shall apply until 3 August 2026.

It shall apply until 3 May 2025, after which it shall elapse permanently.

Amendment 11

Proposal for a regulation

Annex 1 a (new)

Text proposed by the Commission

Amendment

ANNEX I

Template for providers of number-independent interpersonal communications services

PART I

GENERAL REMARKS

Pursuant to Article 3(1), point f, subparagraph (vii) of Regulation 2021/1232, providers of number-independent interpersonal communications services shall fill in the templates in this Annex.

These are the categories of data under this Regulation:

(1) the type and volumes of data processed;

(2) the specific ground relied on for the processing pursuant to Regulation (EU) 2016/679;

(3) the ground relied on for transfers of personal data outside the Union pursuant to Chapter V of Regulation (EU) 2016/679, where applicable;

(4) the number of cases of online child sexual abuse identified, differentiating between online child sexual abuse material;

(5) the number of cases in which a user has lodged a complaint with the internal redress mechanism or with a judicial authority and the outcome of such complaints;

(6) the numbers and ratios of errors (false positives) of the different technologies used;

(7) the measures applied to limit the error rate and the error rate achieved;

(8) the retention policy and the data protection safeguards applied pursuant to Regulation (EU) 2016/679;

(9) the names of the organisations acting in the public interest against child sexual abuse with which data has been shared pursuant to this Regulation;

Justification

As Regulation 2021/1232 does not provide a template for the reporting, providers shared different types of information which were not necessarily comparable which makes it necessary to establish a template to fulfil the obligation for reporting by providers pursuant to Article 3(1)(g)(vii) of Regulation (EU) 2021/1232

Amendment 12

Proposal for a regulation

ANNEX 1 b (new)

Text proposed by the Commission

Amendment

Category according to Article 3(f)(1)(vii)

Subcategory

Description

1) the type and volumes of data processed

Images originating from the EU

Images originating Globally

Videos originating from the EU

Videos originating Globally

Traffic Data relating to User/reportee/account related data

Traffic Data relating to Metadata related to content/transactional data

Traffic Data relating to Data related to a potential victim

Traffic Data relating to abuse operations data

Other indicators

2) the specific ground relied on for the processing pursuant to Regulation (EU) 2016/679

3) the ground relied on for transfers of personal data outside the Union pursuant to Chapter V of Regulation (EU) 2016/679, where applicable

4) the number of cases of online child sexual abuse identified

Images originating from the EU

Images originating Globally

Videos originating from the EU

Videos originating Globally

EU User Account involved

User Accounts globally

Content Items reported to NCMEC

5) the number of cases in which a user has lodged a complaint with the internal redress mechanism or with a judicial authority and the outcome of such complaints;

EU Accounts that have been restricted for sharing CSAM

EU Accounts that have appealed against the restrictions/removal

EU Accounts that have lodged a complaint with the internal mechanism

EU Accounts that have lodged a complaint with the judicial authority

EU Accounts that were reinstated after review

6) the numbers and ratios of errors (false positives) of the different technologies used;

7) the measures applied to limit the error rate and the error rate achieved;

hash-matching technologies

monitoring and quality assessment of the performance of CSA detection tools

human review and oversight: samples of media detected as CSAM by hash-matching technologies are audited by human reviewers/trained analysts

flagging and review of high-volume clusters (Meta);

deployment of further manual review processes as ongoing hash quality checks

human reviewers undergoing specialised robust trainings under guidance of counsel on how to recognise CSAM content to ensure accuracy of human review

periodic quality control assessments of human reviewers and the verdicts that are applied

other quality control processes to reduce errors and immediate remedy, such as independent hash verification (Google, LinkedIn), human review of each instance of never-before-seen CSAM prior to reporting

development and regular review of policies and enforcement strategies by trained subject matter experts on online CSA

engagement with NCMEC CyberTipline

Other indicators

8) the retention policy and the data protection safeguards applied pursuant to Regulation (EU) 2016/679;

The retention period per data category and purpose

Measures to ensure data minimisation

Personal data protection safeguards

9) the names of the organisations acting in the public interest against child sexual abuse with which data has been shared pursuant to this Regulation;

10) Not captured by any other category's keyword.

ANNEX: ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR HAS RECEIVED INPUTS

Pursuant to Article 8 of Annex I to the Rules of Procedure, the rapporteur declares that she has received input from the following entities or persons in the preparation of the report, until the adoption thereof in committee:

Entity and/or person

European Commission, DG Migration and Home Affairs

Permanent Representation of Belgium

Permanent Representation of Germany

European Digital Rights