On the proposal for a regulation of the European Parliament and of the Council laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act)

PA_Legam

AMENDMENTS

The Committee on Civil Liberties, Justice and Home Affairs calls on the Committee on Industry, Research and Energy, as the committee responsible, to take the following into account:

Amendment 1

Proposal for a regulation

Recital 27 a (new)

Text proposed by the Commission

Amendment

(27a) In order to enhance transparency on the processing of personal data within the scope of this Regulation, free and open source technologies are encouraged

Or. en

Amendment 2

Proposal for a regulation

Article 11 – paragraph 2

Text proposed by the Commission

Amendment

2. Regulatory sandboxes shall be operated under the responsibility of the participating public sector bodies and, where the sandbox entails the processing of personal data by public sector bodies, under the supervision of other relevant national authorities, or where the sandbox entails the processing of personal data by institutions, bodies, and agencies of the Union, under the responsibility of the European Data Protection Supervisor.

2. Regulatory sandboxes shall be operated under the responsibility of the participating public sector bodies and, where the sandbox is authorised to process personal data by public sector bodies, under the supervision of other relevant national supervisory authorities, or where the sandbox is authorised to process personal data by institutions, bodies, and agencies of the Union, under the supervision of the European Data Protection Supervisor.

Or. en

Amendment 3

Proposal for a regulation

Article 11 – paragraph 3 – introductory part

Text proposed by the Commission

Amendment

3. The establishment of a regulatory sandbox as set out in paragraph 1 shall aim to contribute to the following objectives:

3. The establishment of a regulatory sandbox as set out in paragraph 1 shall contribute to the following objectives:

Or. en

Amendment 4

Proposal for a regulation

Article 11 – paragraph 5

Text proposed by the Commission

Amendment

5. The Commission, after consulting the Interoperable Europe Board and, where the regulatory sandbox would include the processing of personal data, the European Data Protection Supervisor, shall upon joint request from at least three participating public sector bodies authorise the establishment of a regulatory sandbox. This consultation should not replace the prior consultation referred to in Article 36 of Regulation (EU) 2016/679 and in Article 40 of Regulation (EU) 2018/1725. Where the sandbox is set up for interoperability solutions supporting the cross-border interoperability of network and information systems which are used to provide or manage public services to be delivered or managed electronically by one or more institutions, bodies or agencies of the Union, eventually with the participation of public sector bodies, no authorisation is needed.

5. The Commission, after consulting the Interoperable Europe Board and, where the regulatory sandbox would include the processing of personal data, following a thorough consultation with the European Data Protection Supervisor, shall upon joint request from at least three participating public sector bodies authorise the establishment of a regulatory sandbox. The request shall specify the purpose of the processing of personal data, the actors involved and their roles, the categories of personal data concerned, and their source(s) and the envisaged retention period. This consultation should not replace the prior consultation referred to in Article 36 of Regulation (EU) 2016/679 and in Article 40 of Regulation (EU) 2018/1725. Where the sandbox is set up for interoperability solutions supporting the cross-border interoperability of network and information systems which are used to provide or manage public services to be delivered or managed electronically by one or more institutions, bodies or agencies of the Union, eventually with the participation of public sector bodies, no authorisation is needed.

Or. en

Amendment 5

Proposal for a regulation

Article 12 – paragraph 1

Text proposed by the Commission

Amendment

1. The participating public sector bodies shall ensure that, to the extent the innovative interoperability solution involves the processing of personal data or otherwise falls under the supervisory remit of other national authorities providing or supporting access to data, the national data protection authorities and those other national authorities are associated to the operation of the regulatory sandbox. As appropriate, the participating public sector bodies may allow for the involvement in the regulatory sandbox of other actors within the GovTech ecosystem such as national or European standardisation organisations, notified bodies, research and experimentation labs, innovation hubs, and companies wishing to test innovative interoperability solutions. Cooperation may also be envisaged with third countries establishing mechanisms to support innovative interoperability solutions for the public sector.

1. The participating public sector bodies shall ensure that, to the extent the interoperability solution involves the processing of personal data or otherwise falls under the supervisory remit of other national supervisory authorities providing or supporting access to data, the national data protection authorities and those other national authorities are associated to the operation of the regulatory sandbox. As appropriate, the participating public sector bodies may allow for the involvement in the regulatory sandbox of other actors within the GovTech ecosystem such as national or European standardisation organisations, notified bodies, research and experimentation labs, innovation hubs, and companies wishing to test interoperability solutions. Cooperation may only be envisaged with third countries establishing mechanisms to support interoperability solutions for the public sector where such cooperation is in compliance with Union law on the protection of personal data.

Or. en

Amendment 6

Proposal for a regulation

Article 12 – paragraph 2

Text proposed by the Commission

Amendment

2. Participation in the regulatory sandbox shall be limited to a period that is appropriate to the complexity and scale of the project, and in any case not longer than 2 years from the establishment of the regulatory sandbox. The participation may be extended for up to one more year if necessary to achieve the purpose of the processing.

2. Participation in the regulatory sandbox shall be limited to a period that is appropriate to the complexity and scale of the project, and in any case not longer than one year from the establishment of the regulatory sandbox.

Or. en

Amendment 7

Proposal for a regulation

Article 12 – paragraph 3 – introductory part

Text proposed by the Commission

Amendment

3. Participation in the regulatory sandbox shall be based on a specific plan elaborated by the participants taking into account the advice of other national competent authorities or the European Data Protection Supervisor, as applicable. The plan shall contain as a minimum the following:

3. Participation in the regulatory sandbox shall be based on a specific plan. Participants shall elaborate that specific plan by taking into account the advice of other national competent authorities or the European Data Protection Supervisor, as applicable. The plan shall contain as a minimum the following:

Or. en

Amendment 8

Proposal for a regulation

Article 12 – paragraph 3 – point c

Text proposed by the Commission

Amendment

(c) the specific modalities of the collaboration between the participants and the authorities, as well as any other actor involved in the regulatory sandbox;

(c) the specific modalities of the collaboration between the participants and the supervisory authorities, as well as any other actor involved in the regulatory sandbox;

Or. en

Amendment 9

Proposal for a regulation

Article 12 – paragraph 3 – point g

Text proposed by the Commission

Amendment

(g) where personal data are processed, an indication of the categories of personal data concerned, the purposes of the processing for which the personal data are intended and the actors involved in the processing and their role.

(g) where it is strictly necessary and proportionate to process personal data, the reasons for such processing, an indication of the categories of personal data concerned, the purposes of the processing for which the personal data are intended, the controllers, processors and recipients involved in the processing and their role.

Or. en

Amendment 10

Proposal for a regulation

Article 12 – paragraph 6 – introductory part

Text proposed by the Commission

Amendment

6. Personal data may be processed in the regulatory sandbox subject to the following cumulative conditions:

6. Personal data may only be processed in the regulatory sandbox subject to the following cumulative conditions:

Or. en

Amendment 11

Proposal for a regulation

Article 12 – paragraph 6 – point d

Text proposed by the Commission

Amendment

(d) any personal data to be processed are in a functionally separate, isolated and protected data processing environment under the control of the participants and only authorised persons have access to that data;

(d) any personal data to be processed are in a functionally separate, isolated and protected data processing environment under the control of the participants and only duly authorised persons have access to that data;

Or. en

Amendment 12

Proposal for a regulation

Article 12 – paragraph 6 – point f

Text proposed by the Commission

Amendment

(f) any processing of personal data does not affect the application of the rights of the data subjects as provided for under Union law on the protection of personal data, in particular in Article 22 of Regulation (EU) 2016/679 and Article 24 of Regulation (EU) 2018/1725;

(f) the application of the rights of the data subjects as provided for under Union law on the protection of personal data is fully ensured by participants in the sandbox, including through appropriate technical and organisational arrangements;

Or. en

Amendment 13

Proposal for a regulation

Article 12 – paragraph 6 – point f a (new)

Text proposed by the Commission

Amendment

(fa) any personal data are not processed for any further purpose than for the purpose for which the personal data were originally collected;

Or. en

Justification

Any subsequent purpose change shall be prohibited and therefore the test data in question, which has been enriched in the sandbox, may not become data in a production environment again.

Amendment 14

Proposal for a regulation

Article 12 – paragraph 10

Text proposed by the Commission

Amendment

10. Where a regulatory sandbox involves the use of artificial intelligence, the rules set out under Article 53 and 54 of the [proposal for a] Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) and amending certain Union legislative acts shall prevail in case of conflict with the rules set out by the Regulation.

deleted

Or. en