Sittings · Document
On the proposal for a regulation of the European Parliament and of the Council Amending Regulation (EU) 2021/1232 of the European Parliament and of the Council on a temporary derogation from certain provisions of Directive 2002/58/EC for the purpose of combating online child sexual abuse
Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Birgit Sippel
PR_COD_1amCom
Symbols for procedures
* Consultation procedure
*** Consent procedure
***I Ordinary legislative procedure (first reading)
***II Ordinary legislative procedure (second reading)
***III Ordinary legislative procedure (third reading)
(The type of procedure depends on the legal basis proposed by the draft act.)
Amendments to a draft act
Amendments by Parliament set out in two columns
Deletions are indicated in bold italics in the left-hand column. Replacements are indicated in bold italics in both columns. New text is indicated in bold italics in the right-hand column.
The first and second lines of the header of each amendment identify the relevant part of the draft act under consideration. If an amendment pertains to an existing act that the draft act is seeking to amend, the amendment heading includes a third line identifying the existing act and a fourth line identifying the provision in that act that Parliament wishes to amend.
Amendments by Parliament in the form of a consolidated text
New text is highlighted in bold italics. Deletions are indicated using either the ▌symbol or strikeout. Replacements are indicated by highlighting the new text in bold italics and by deleting or striking out the text that has been replaced.
By way of exception, purely technical changes made by the drafting departments in preparing the final text are not highlighted.
DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION
on the proposal for a regulation of the European Parliament and of the Council Amending Regulation (EU) 2021/1232 of the European Parliament and of the Council on a temporary derogation from certain provisions of Directive 2002/58/EC for the purpose of combating online child sexual abuse
(COM(2023)0777 – C90437/2023 – 2023/0452(COD))
(Ordinary legislative procedure: first reading)
– having regard to the Commission proposal to Parliament and the Council (COM(2023)0777),
– having regard to Article 294(2), Article 16(2) and Article 114(1) of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90437/2023),
– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,
– having regard to the opinion of the European Economic and Social Committee (XXXX)
–– having regard to Rule 59 of its Rules of Procedure,
– having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A90000/2024),
1. Adopts its position at first reading hereinafter set out;
2. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;
3. Instructs its President to forward its position to the Council, the Commission and the national parliaments.
Amendment 1
Proposal for a regulation
Citation 4 a (new)
Text proposed by the Commission
Amendment
Having regard to the Report from the European Commission on the implementation of Regulation (EU) 2021/1232 of the European Parliament and of the Council of 14 July 2021 on a temporary derogation from certain provisions of Directive 2002/58/EC as regards the use of technologies by providers of number- independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse (COM(2023) 797 final)
Or. en
Amendment 2
Proposal for a regulation
Recital -1 (new)
Text proposed by the Commission
Amendment
(-1) In order to facilitate compliance with providers’ reporting obligations, in particular to ensure the machine-readability and easy accessibility of the reports, the publication format for the reports pursuant to Article 3(1)(f)(vii) of Regulation 2021/1232 should be harmonised.
Or. en
Amendment 3
Proposal for a regulation
Recital 1 a (new)
Text proposed by the Commission
Amendment
(1a) In order to ensure an adequate level of transparency and accountability, as well as to enable comprehensive and comparable reporting, it is necessary to lay down templates concerning the details of the reports that providers of number-independent interpersonal communications services should publish and submit to the competent supervisory authority and to the Commission on the processing of personal data under Regulation 2021/1232.
Or. en
Amendment 4
Proposal for a regulation
Recital 1 b (new)
Text proposed by the Commission
Amendment
(1b) In order to enable effective scrutiny over processing of personal data, providers of number-independent interpersonal communications services should use the template and the instructions laid out in the Annex to this Regulation when complying with their reporting obligations pursuant to Regulation (EU) 2021/1232.
Or. en
Amendment 5
Proposal for a regulation
Recital 4 a (new)
Text proposed by the Commission
Amendment
(4a) In light of the implementing report from the European Commission of 19 December 2023 (COM(2023) 797) and to ensure consistency and clarity, definitions which are no longer relevant should be deleted from Regulation 2021/1232. Since the scope of this Regulation does not include solicitation of children, its definition should be deleted.
Or. en
Amendment 6
Proposal for a regulation
Recital 4 b (new)
Regulation (EU) 2021/1232
Recital 16
Present text
Amendment
(4b) In Recital 16 of Regulation (EU) 2021/1232, the text is replaced by the following:
(16) The types of technologies used for the purposes of this Regulation should be the least privacy-intrusive in accordance with the state of the art in the industry. Those technologies should not be used to systematically filter and scan text in communications unless it is solely to detect patterns which point to possible concrete reasons for suspecting online child sexual abuse, and they should not be able to deduce the substance of the content of the communications. In the case of technology used for identifying solicitation of children, such concrete reasons for suspicion should be based on objectively identified risk factors such as age difference and the likely involvement of a child in the scanned communication.
(16) The types of technologies used for the purposes of this Regulation should be the least privacy-intrusive in accordance with the state of the art in the industry. Those technologies should not be used to systematically filter and scan text in communications unless it is solely to detect patterns which point to possible concrete reasons for suspecting online child sexual abuse, and they should not be able to deduce the substance of the content of the communications.
Or. en
(32021R1232)
Amendment 7
Proposal for a regulation
Recital 4 c (new)
Regulation (EU) 2021/1232
Recital 21
Present text
Amendment
(4c) In Recital 21 of Regulation (EU) 2021/1232, the text is replaced by the following:
(21) In order to ensure transparency and accountability in respect of the activities undertaken pursuant to the derogation provided for by this Regulation, providers should, by 3 February 2022, and by 31 January every year thereafter, publish and submit reports to the competent supervisory authority designated pursuant to Regulation (EU) 2016/679 (‘supervisory authority’) and to the Commission. Such reports should cover processing falling within the scope of this Regulation, including the type and volumes of data processed, the specific grounds relied on for the processing of personal data pursuant to Regulation (EU) 2016/679, the grounds relied on for transfers of personal data outside the Union pursuant to Chapter V of Regulation (EU) 2016/679, where applicable, the number of cases of online child sexual abuse identified, differentiating between online child sexual abuse material and solicitation of children, the number of cases in which a user has lodged a complaint with the internal redress mechanism or sought a judicial remedy and the outcome of such complaints and judicial proceedings, the numbers and ratios of errors (false positives) of the different technologies used, the measures applied to limit the error rate and the error rate achieved, the retention policy and the data protection safeguards applied pursuant to Regulation (EU) 2016/679, and the names of the organisations acting in the public interest against child sexual abuse with which data have been shared pursuant to this Regulation.
(21) In order to ensure transparency and accountability in respect of the activities undertaken pursuant to the derogation provided for by this Regulation, providers should, by 3 February 2022, and by 31 January every year thereafter, publish and submit reports to the competent supervisory authority designated pursuant to Regulation (EU) 2016/679 (‘supervisory authority’) and to the Commission. Such reports should cover processing falling within the scope of this Regulation, including the type and volumes of data processed, the specific grounds relied on for the processing of personal data pursuant to Regulation (EU) 2016/679, the grounds relied on for transfers of personal data outside the Union pursuant to Chapter V of Regulation (EU) 2016/679, where applicable, the number of cases of online child sexual abuse identified, the number of cases in which a user has lodged a complaint with the internal redress mechanism or sought a judicial remedy and the outcome of such complaints and judicial proceedings, the numbers and ratios of errors (false positives) of the different technologies used, the measures applied to limit the error rate and the error rate achieved, the retention policy and the data protection safeguards applied pursuant to Regulation (EU) 2016/679, and the names of the organisations acting in the public interest against child sexual abuse with which data have been shared pursuant to this Regulation.
Or. en
(32021R1232)
Amendment 8
Proposal for a regulation
Article -1 (new)
Regulation (EU) 2021/1232
Article 2 – point 3
Text proposed by the Commission
Amendment
Article -1
In Article 2, the third paragraph is deleted.
Or. en
(32021R1232)
Amendment 9
Proposal for a regulation
Article -1 a (new)
Regulation (EU) 2021/1232
Text proposed by the Commission
Amendment
Article -1a
Template for the reporting
(1) To ensure that the reports are machine-readable, providers shall publish the report in a CSV (comma-separated values) format. The Commission shall make available online the CSV- and XLSX-versions of the template in Annex I.
(2) For providers of number-independent interpersonal communications services, the first reporting cycle following the full entry into application date of Regulation (EU) 20XX/XX on 04 August 2024 shall cover the period 01 January 2024 until 31 December 2024. In case the period 01 January until 04 August 2024 does not follow the template set out in Annex I to this Regulation, it shall be included in a separate section of the next report.
Or. en
Amendment 10
Proposal for a regulation
Article -1 b (new)
Regulation (EU) 2021/1232
Article 3 – paragraph 1 – point a – point i
Present text
Amendment
Article -1b
In Article 3, paragraph 1, point (a)(i) is replaced by the following:
“(i) strictly necessary for the use of specific technology for the sole purpose of detecting and removing online child sexual abuse material and reporting it to law enforcement authorities and to organisations acting in the public interest against child sexual abuse and of detecting solicitation of children and reporting it to law enforcement authorities or organisations acting in the public interest against child sexual abuse;”
(i) strictly necessary for the use of specific technology for the sole purpose of detecting and removing online child sexual abuse material and reporting it to law enforcement authorities and to organisations acting in the public interest against child sexual abuse;
Or. en
(32021R1232)
Amendment 11
Proposal for a regulation
Article -1 c (new)
Regulation (EU) 2021/1232
Article 3 – paragraph 1 – point d
Present text
Amendment
Article -1c
In Article 3, paragraph 1, point (d) is replaced by the following:
“(d) with regard to new technology, meaning technology used for the purpose of detecting online child sexual abuse mat erial that has not been used by any provider in relation to services provided to users of number-independent interpersonal communications services (‘users’) in the Union before 2 August 2021, and with regard to technology used for the purpose of identifying possible solicitation of children, the provider reports back to the competent authority on the measures taken to demonstrate compliance with written advice issued in accordance with Article 36(2) of Regulation (EU) 2016/679 by the competent supervisory authority designated pursuant to Chapter VI, Section 1, of that Regulation (‘supervisory authority’) in the course of the prior consultation procedure;”
(d) with regard to new technology, meaning technology used for the purpose of detecting online child sexual abuse mat erial that has not been used by any provider in relation to services provided to users of number-independent interpersonal communications services (‘users’) in the Union before 2 August 2021, the provider reports back to the competent authority on the measures taken to demonstrate compliance with written advice issued in accordance with Article 36(2) of Regulation (EU) 2016/679 by the competent supervisory authority designated pursuant to Chapter VI, Section 1, of that Regulation (‘supervisory authority’) in the course of the prior consultation procedure;
Or. en
(32021R1232)
Amendment 12
Proposal for a regulation
Article -1 d (new)
Regulation (EU) 2021/1232
Article 3 – paragraph 1 – point f
Text proposed by the Commission
Amendment
Article -1d
In Article 3, paragraph 1, point (f) is deleted.
Or. en
(32021R1232)
Amendment 13
Proposal for a regulation
Article -1 e (new)
Regulation (EU) 2021/1232
Article 3 – paragraph 1 – point g – point iii
Present text
Amendment
Article -1e
In Article 3, paragraph 1, point (g)(iii) is replaced by the following:
” (iii) ensure that material not previously identified as online child sexual abuse material, or solicitation of children, is not reported to law enforcement authorities or organisations acting in the public interest against child sexual abuse without prior human confirmation; ”
” (iii) ensure that material not previously identified as online child sexual abuse material, is not reported to law enforcement authorities or organisations acting in the public interest against child sexual abuse without prior human confirmation; ”
Or. en
(32021R1232)
Amendment 14
Proposal for a regulation
Article -1 f (new)
Regulation (EU) 2021/1232
Article 3 – paragraph 1 – point g – point iii – point 4
Present text
Amendment
Article -1f
In Article 3, paragraph 1, point (g)(iii)(4) is replaced by the following:
” (4) the number of cases of online child sexual abuse identified, differentiating between online child sexual abuse material and solicitation of children; ”
” (4) the number of cases of online child sexual abuse identified; ”
Or. en
(32021R1232)
Amendment 15
Proposal for a regulation
Article 1 – paragraph 1
Regulation (EU) 2021/1232
Article 10 – paragraph 2
Text proposed by the Commission
Amendment
It shall apply until 3 August 2026.
It shall apply until 3 May 2025.
Or. en
Amendment 16
Proposal for a regulation
Annex 1 a (new)
Text proposed by the Commission
Amendment
ANNEX I
Template for providers of number-independent interpersonal communications services
PART I
GENERAL REMARKS
Pursuant to Article 3(1), point f, subparagraph (vii) of Regulation 2021/1232, providers of number-independent interpersonal communications services shall fill in the templates in this Annex.
These are the categories in the Regulation:
(1) the type and volumes of data processed;
(2) the specific ground relied on for the processing pursuant to Regulation (EU) 2016/679;
(3) the ground relied on for transfers of personal data outside the Union pursuant to Chapter V of Regulation (EU) 2016/679, where applicable;
(4) the number of cases of online child sexual abuse identified, differentiating between online child sexual abuse material;
(5) the number of cases in which a user has lodged a complaint with the internal redress mechanism or with a judicial authority and the outcome of such complaints;
(6) the numbers and ratios of errors (false positives) of the different technologies used;
(7) the measures applied to limit the error rate and the error rate achieved;
(8) the retention policy and the data protection safeguards applied pursuant to Regulation (EU) 2016/679;
(9) the names of the organisations acting in the public interest against child sexual abuse with which data has been shared pursuant to this Regulation;
Or. en
Justification
As Regulation 2021/1232 does not provide a template for the reporting, providers shared different types of information which were not necessarily comparable which makes it necessary to establish a template to fulfil the obligation for reporting by providers pursuant to Article 3(1)(g)(vii) of Regulation (EU) 2021/1232
Amendment 17
Proposal for a regulation
ANNEX 1 b (new)
Text proposed by the Commission
Amendment
Category according to Article 3(f)(1)(vii)
Subcategory
Description
1) the type and volumes of data processed
Images originating from the EU
Images originating Globally
Videos originating from the EU
Videos originating Globally
Traffic Data relating to User/reportee/account related data
Traffic Data relating to Metadata related to content/transactional data
Traffic Data relating to Data related to a potential victim
Traffic Data relating to abuse operations data
Other indicators
2) the specific ground relied on for the processing pursuant to Regulation (EU) 2016/679
3) the ground relied on for transfers of personal data outside the Union pursuant to Chapter V of Regulation (EU) 2016/679, where applicable
4) the number of cases of online child sexual abuse identified
Images originating from the EU
Images originating Globally
Videos originating from the EU
Videos originating Globally
EU User Account involved
User Accounts globally
Content Items reported to NCMEC
5) the number of cases in which a user has lodged a complaint with the internal redress mechanism or with a judicial authority and the outcome of such complaints;
EU Accounts that have been restricted for sharing CSAM
EU Accounts that have appealed against the restrictions/removal
EU Accounts that have lodged a complaint with the internal mechanism
EU Accounts that have lodged a complaint with the judicial authority
EU Accounts that were reinstated after review
6) the numbers and ratios of errors (false positives) of the different technologies used;
7) the measures applied to limit the error rate and the error rate achieved;
hash-matching technologies
monitoring and quality assessment of the performance of CSA detection tools
human review and oversight: samples of media detected as CSAM by hash-matching technologies are audited by human reviewers/trained analysts
flagging and review of high-volume clusters (Meta);
deployment of further manual review processes as ongoing hash quality checks
human reviewers undergoing specialised robust trainings under guidance of counsel on how to recognise CSAM content to ensure accuracy of human review
periodic quality control assessments of human reviewers and the verdicts that are applied
other quality control processes to reduce errors and immediate remedy, such as independent hash verification (Google, LinkedIn), human review of each instance of never-before-seen CSAM prior to reporting
development and regular review of policies and enforcement strategies by trained subject matter experts on online CSA
engagement with NCMEC CyberTipline
Other indicators
8) the retention policy and the data protection safeguards applied pursuant to Regulation (EU) 2016/679;
The retention period per data category and purpose
Measures to ensure data minimisation
Personal data protection safeguards
9) the names of the organisations acting in the public interest against child sexual abuse with which data has been shared pursuant to this Regulation;
10) Not captured by any other category's keyword.
Or. en
ANNEX: ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR HAS RECEIVED INPUTS
Pursuant to Article 8 of Annex I to the Rules of Procedure, the rapporteur declares that she has received input from the following entities or persons in the preparation of the draft report:
Entity and/or person
European Commission, DG Migration and Home Affairs
Permanent Representation of Belgium
Permanent Representation of Germany
European Digital Rights
Meta
Microsoft
The list above is drawn up under the exclusive responsibility of the rapporteur.