On the proposal for a regulation of the European Parliament and of the Council laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act)
LIBE-PA-746882
Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Cyrus Engerer
Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.
The Committee on Civil Liberties, Justice and Home Affairs proposes amendments to the proposed Interoperable Europe Act. It encourages free and open source technologies for transparency, and tightens data protection rules for regulatory sandboxes, including supervision by data protection authorities and the European Data Protection Supervisor.¶¶¶ It limits sandbox participation to one year, requires a specific plan, and allows personal data processing only under cumulative conditions. It bans further processing for other purposes and deletes the rule that the Artificial Intelligence Act prevails in conflicts.¶¶¶
Committee position. The Committee on Civil Liberties, Justice and Home Affairs proposes amendments to strengthen data protection in the Interoperable Europe Act, including supervision by data protection authorities, a one-year sandbox limit, strict processing conditions, a ban on further processing, and deletion of the Artificial Intelligence Act conflict rule.¶¶¶
Key points
- Calls on the Committee on Industry, Research and Energy to take into account amendments encouraging free and open source technologies to enhance transparency on personal data processing.¶¶
- Requires regulatory sandboxes processing personal data by public sector bodies to be supervised by other relevant national supervisory authorities, and those processing personal data by Union institutions, bodies and agencies by the European Data Protection Supervisor.¶
- States that establishing a regulatory sandbox shall contribute to the objectives in paragraph 1.¶
- Requires the Commission, after consulting the Interoperable Europe Board and the European Data Protection Supervisor, to authorise a sandbox upon joint request from at least three participating public sector bodies; the request must specify the purpose, actors, data categories, sources and retention period.¶
- Requires participating public sector bodies to associate national data protection authorities and other national authorities when the sandbox involves personal data or falls under their remit, and allows cooperation with third countries only if compliant with Union law on personal data protection.¶
- Limits participation in the regulatory sandbox to no longer than one year from its establishment, removing the possibility of extension.¶
- Requires participants to elaborate a specific plan taking into account advice from other national competent authorities or the European Data Protection Supervisor, including modalities of collaboration and reasons for processing personal data.¶¶¶
- Allows personal data processing in the sandbox only under cumulative conditions, including a functionally separate, isolated and protected environment accessible only to duly authorised persons, and full application of data subject rights through technical and organisational arrangements.¶¶¶
- Prohibits processing personal data for any further purpose than originally collected, and bans enriched test data from returning to a production environment.¶¶
- Deletes the provision that the Artificial Intelligence Act rules prevail in case of conflict for sandboxes involving artificial intelligence.¶
Who is affected
- Public sector bodies participating in regulatory sandboxes must ensure supervision and comply with data protection conditions.¶¶¶
- National data protection authorities and other national supervisory authorities must be associated with sandbox operations involving personal data.
- The European Data Protection Supervisor supervises sandboxes processing personal data by Union institutions, bodies and agencies, and must be consulted on authorisation.¶¶
- The Commission authorises sandbox establishment after consulting the Interoperable Europe Board and the European Data Protection Supervisor.
- Third countries may cooperate only where compliant with Union law on personal data protection.¶