On the proposal for a regulation of the European Parliament and of the Council laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act)

PA_Legam

AMENDMENTS

The Committee on Civil Liberties, Justice and Home Affairs calls on the Committee on Industry, Research and Energy, as the committee responsible, to take the following into account:

Amendment 1

Proposal for a regulation

Recital 4 a (new)

Text proposed by the Commission

Amendment

(4a) In the pursuit of cross-border interoperability and the digital public services infrastructure, it is crucial to safeguard the privacy and protection of personal data. The interoperability measures established under this Regulation should be designed and implemented in a manner that respects the principles of data protection rules.

Amendment 2

Proposal for a regulation

Recital 27 a (new)

Text proposed by the Commission

Amendment

(27a) In order to enhance transparency on the processing of personal data within the scope of this Regulation, free and open source technologies are encouraged

Amendment 3

Proposal for a regulation

Article 11 – paragraph 2

Text proposed by the Commission

Amendment

2. Regulatory sandboxes shall be operated under the responsibility of the participating public sector bodies and, where the sandbox entails the processing of personal data by public sector bodies, under the supervision of other relevant national authorities, or where the sandbox entails the processing of personal data by institutions, bodies, and agencies of the Union, under the responsibility of the European Data Protection Supervisor.

2. Innovative sandboxes shall be operated under the responsibility of the participating public sector bodies and, where the sandbox is authorised to process personal data by public sector bodies, under the supervision of other relevant national supervisory authorities, or where the sandbox is authorised to process personal data by institutions, bodies, and agencies of the Union, under the supervision of the European Data Protection Supervisor.

Amendment 4

Proposal for a regulation

Article 11 – paragraph 3 – introductory part

Text proposed by the Commission

Amendment

3. The establishment of a regulatory sandbox as set out in paragraph 1 shall aim to contribute to the following objectives:

3. The establishment of an innovative sandbox as set out in paragraph 1 shall contribute to the following objectives:

Amendment 5

Proposal for a regulation

Article 11 – paragraph 5

Text proposed by the Commission

Amendment

5. The Commission, after consulting the Interoperable Europe Board and, where the regulatory sandbox would include the processing of personal data, the European Data Protection Supervisor, shall upon joint request from at least three participating public sector bodies authorise the establishment of a regulatory sandbox. This consultation should not replace the prior consultation referred to in Article 36 of Regulation (EU) 2016/679 and in Article 40 of Regulation (EU) 2018/1725. Where the sandbox is set up for interoperability solutions supporting the cross-border interoperability of network and information systems which are used to provide or manage public services to be delivered or managed electronically by one or more institutions, bodies or agencies of the Union, eventually with the participation of public sector bodies, no authorisation is needed.

5. The Commission, after consulting the Interoperable Europe Board and, where the innovative sandbox would include the processing of personal data, following a thorough consultation with the European Data Protection Supervisor, shall upon joint request from at least three participating public sector bodies authorise the establishment of an innovative sandbox. The request shall specify the purpose of the processing of personal data, the actors involved and their roles, the categories of personal data concerned, and their source(s) and the envisaged retention period. This consultation should not replace the prior consultation referred to in Article 36 of Regulation (EU) 2016/679 and in Article 40 of Regulation (EU) 2018/1725. Where the sandbox is set up for interoperability solutions supporting the cross-border interoperability of network and information systems, which are used to provide or manage public services to be delivered or managed electronically by one or more institutions, bodies or agencies of the Union, eventually with the participation of public sector bodies, no authorisation is needed.

Amendment 6

Proposal for a regulation

Article 12 – paragraph 2

Text proposed by the Commission

Amendment

2. Participation in the regulatory sandbox shall be limited to a period that is appropriate to the complexity and scale of the project, and in any case not longer than 2 years from the establishment of the regulatory sandbox. The participation may be extended for up to one more year if necessary to achieve the purpose of the processing.

2. Participation in the innovative sandbox shall be limited to a period that is appropriate to the complexity and scale of the project, and in any case not longer than one year from the establishment of the innovative sandbox.

Amendment 7

Proposal for a regulation

Article 12 – paragraph 3 – point b

Text proposed by the Commission

Amendment

(b) the specific regulatory issues at stake and the guidance that is expected from the authorities supervising the regulatory sandbox;

(b) the specific issues at stake and the guidance that is expected from the authorities supervising the innovative sandbox;

Amendment 8

Proposal for a regulation

Article 12 – paragraph 3 – point c

Text proposed by the Commission

Amendment

(c) the specific modalities of the collaboration between the participants and the authorities, as well as any other actor involved in the regulatory sandbox;

(c) the specific modalities of the collaboration between the participants and the supervisory authorities, as well as any other actor involved in the innovative sandbox;

Amendment 9

Proposal for a regulation

Article 12 – paragraph 3 – point g

Text proposed by the Commission

Amendment

(g) where personal data are processed, an indication of the categories of personal data concerned, the purposes of the processing for which the personal data are intended and the actors involved in the processing and their role.

(g) where it is strictly necessary and proportionate to process personal data, the reasons for such processing, an indication of the categories of personal data concerned, the purposes of the processing for which the personal data are intended, the controllers, processors and recipients involved in the processing and their role.

Amendment 10

Proposal for a regulation

Article 12 – paragraph 6 – introductory part

Text proposed by the Commission

Amendment

6. Personal data may be processed in the regulatory sandbox subject to the following cumulative conditions:

6. Personal data may only be processed in the innovative sandbox subject to the following cumulative conditions:

Amendment 11

Proposal for a regulation

Article 12 – paragraph 6 – point d

Text proposed by the Commission

Amendment

(d) any personal data to be processed are in a functionally separate, isolated and protected data processing environment under the control of the participants and only authorised persons have access to that data;

(d) any personal data to be processed are in a functionally separate, isolated and protected data processing environment under the control of the participants and only duly authorised persons have access to that data;

Amendment 12

Proposal for a regulation

Article 12 – paragraph 6 – point f

Text proposed by the Commission

Amendment

(f) any processing of personal data does not affect the application of the rights of the data subjects as provided for under Union law on the protection of personal data, in particular in Article 22 of Regulation (EU) 2016/679 and Article 24 of Regulation (EU) 2018/1725;

(f) any processing of personal data does not affect the application of the rights of the data subjects as provided for under Union law on the protection of personal data, and is fully ensured by participants in the innovative sandbox, including through appropriate technical and organisational arrangements;

Amendment 13

Proposal for a regulation

Article 12 – paragraph 6 – point f a (new)

Text proposed by the Commission

Amendment

(fa) personal data are not processed for purposes other than those for which the personal data were initially collected;

Amendment 14

Proposal for a regulation

Article 12 – paragraph 10

Text proposed by the Commission

Amendment

10. Where a regulatory sandbox involves the use of artificial intelligence, the rules set out under Article 53 and 54 of the [proposal for a] Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) and amending certain Union legislative acts shall prevail in case of conflict with the rules set out by the Regulation.

deleted

PROCEDURE – COMMITTEE ASKED FOR OPINION

Title

Laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act)

References

COM(2022)0720 – C9-0387/2022 – 2022/0379(COD)

Committee responsible

Date announced in plenary

ITRE

21.11.2022

Opinion by

Date announced in plenary

LIBE

21.11.2022

Associated committees - date announced in plenary

16.3.2023

Rapporteur for the opinion

Date appointed

Cyrus Engerer

13.4.2023

Discussed in committee

23.5.2023

Date adopted

29.6.2023

Result of final vote

+:

–:

0:

37

8

4

Members present for the final vote

Katarina Barley, Pietro Bartolo, Theresa Bielowski, Malin Björk, Vasile Blaga, Saskia Bricmont, Annika Bruna, Jorge Buxadé Villalba, Damien Carême, Patricia Chagnon, Clare Daly, Anna Júlia Donáth, Lena Düpont, Cornelia Ernst, Maria Grapini, Sylvie Guillaume, Sophia in ‘t Veld, Patryk Jaki, Assita Kanko, Fabienne Keller, Łukasz Kohut, Alice Kuhnke, Jeroen Lenaers, Juan Fernando López Aguilar, Lukas Mandl, Erik Marquardt, Javier Moreno Sánchez, Maite Pagazaurtundúa, Pina Picierno, Karlo Ressler, Diana Riba i Giner, Isabel Santos, Birgit Sippel, Tineke Strik, Ramona Strugariu, Tomas Tobé, Yana Toom, Javier Zarzalejos

Substitutes present for the final vote

José Gusmão, Matjaž Nemec, Bergur Løkke Rasmussen, Dragoş Tudorache, Tom Vandenkendelaere, Petar Vitanov

Substitutes under Rule 209(7) present for the final vote

Frances Fitzgerald, Martin Hojsík, Rasa Juknevičienė, Andrius Kubilius, Janina Ochojska

FINAL VOTE BY ROLL CALL IN COMMITTEE ASKED FOR OPINION

Key to symbols: