European Parliament 2019-2024

Committee on Civil Liberties, Justice and Home Affairs

PE691.441v01-00

26.4.2021

AMENDMENTS 1 - 161

Draft report Juan Fernando López Aguilar (PE691.241v01-00)

The adequate protection of personal data by the United Kingdom

AM\1229955EN.docx PE691.441v01-00

EN United in diversityEN AM_Com_NonLegReport

PE691.441v01-00 2/88 AM\1229955EN.docx EN Amendment 1 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Citation 1

Draft motion for a resolution Amendment

— having regard to the Charter of — having regard to the Charter of Fundamental Rights of the European Union Fundamental Rights of the European Union (the Charter), in particular Articles 7, 8, 47 (the Charter), in particular Articles 6, 7, 8, and 52 thereof, 16, 47 and 52 thereof,

Or. en

Amendment 2 Assita Kanko

Draft motion for a resolution Citation 2

Draft motion for a resolution Amendment

— having regard to the judgment of deleted the Court of Justice of the European Union (CJEU) of 16 July 2020 in case C- 311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems (Schrems II judgment)1 , ______1 ECLI:EU:C:2020:559.

Or. en

Amendment 3 Assita Kanko

Draft motion for a resolution Citation 3

Draft motion for a resolution Amendment

— having regard to the judgment of deleted the CJEU of 6 October 2015 in case C-

AM\1229955EN.docx 3/88 PE691.441v01-00 EN 362/14, Maximillian Schrems v Data Protection Commissioner (Schrems I judgment)2 , ______2 ECLI:EU:C:2015:650.

Or. en

Amendment 4 Assita Kanko

Draft motion for a resolution Citation 5

Draft motion for a resolution Amendment

— having regard to its resolution of deleted 12 March 2014 on the US NSA surveillance programme, surveillance bodies in various Member States and their impact on EU citizens’ fundamental rights and on transatlantic cooperation in Justice and Home Affairs4 , ______4 OJ C 378, 9.11.2017, p. 104.

Or. en

Amendment 5 Assita Kanko

Draft motion for a resolution Citation 6

Draft motion for a resolution Amendment

— having regard to its resolution of 5 deleted July 2018 on the adequacy of the protection afforded by the EU-US Privacy Shield5 , ______5 OJ C 118, 8.4.2020, p. 133.

PE691.441v01-00 4/88 AM\1229955EN.docx EN Or. en

Amendment 6 Gwendoline Delbos-Corfield

Draft motion for a resolution Citation 7 a (new)

Draft motion for a resolution Amendment

— having regard to its resolution of XX April 2021 on the judgment of the CJEU of 16 July 2020 - Data Protection Commissioner v Facebook Ireland Limited, Maximilian Schrems;

Or. en

Amendment 7 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Citation 12

Draft motion for a resolution Amendment

— having regard to Directive (EU) — having regard to Directive (EU) 2016/680 of the European Parliament and 2016/680 of the European Parliament and of the Council of 27 April 2016 on the of the Council of 27 April 2016 on the protection of natural persons with regard to protection of natural persons with regard to the processing of personal data by the processing of personal data by competent authorities for the purposes of competent authorities for the purposes of the prevention, investigation, detection or the prevention, investigation, detection or prosecution of criminal offences or the prosecution of criminal offences or the execution of criminal penalties, and on the execution of criminal penalties, and in free movement of such data (the Law particular Article 45(3) thereof, and on Enforcement Directive for Data the free movement of such data (the Law Protection)10 , Enforcement Directive for Data Protection, 'LED')10, in particular Article 36(3) thereof, ______10 OJ L 119, 4.5.2016, p. 89. 10 OJ L 119, 4.5.2016, p. 89.

Or. en

AM\1229955EN.docx 5/88 PE691.441v01-00 EN Amendment 8 Assita Kanko

Draft motion for a resolution Citation 14

Draft motion for a resolution Amendment

— having regard to the Commission deleted proposal of 10 January 2017 for a regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications – COM(2017)0010) and the European Parliament’s position thereon adopted on 20 October 201712 , ______12 A8-0324/2017.

Or. en

Amendment 9 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Citation 14

Draft motion for a resolution Amendment

— having regard to the Commission deleted proposal of 10 January 2017 for a regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications – COM(2017)0010) and the European Parliament’s position thereon adopted on 20 October 201712 ,

PE691.441v01-00 6/88 AM\1229955EN.docx EN ______12 A8-0324/2017.

Or. en

Amendment 10 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Citation 19

Draft motion for a resolution Amendment

— having regard to the EDPB opinion — having regard to EDPB opinions of XXXX on the draft adequacy decisions 14/2021 and 15/2021 of 13 April 2021 on for the UK, the draft adequacy decisions for the UK,

Or. en

Amendment 11 Gwendoline Delbos-Corfield

Draft motion for a resolution Citation 19

Draft motion for a resolution Amendment

— having regard to the EDPB opinion — having regard to the EDPB opinion of XXXX on the draft adequacy decisions of 13 April 2021 on the draft adequacy for the UK, decisions for the UK,

Or. en

Amendment 12 Assita Kanko

Draft motion for a resolution Citation 19 a (new)

Draft motion for a resolution Amendment

— having regard to the European Convention of Human Rights and to “Convention 108” of the Council of

AM\1229955EN.docx 7/88 PE691.441v01-00 EN Europe, to which the UK is a party;

Or. en

Amendment 13 Sophia in 't Veld

Draft motion for a resolution Citation 20

Draft motion for a resolution Amendment

— having regard to Rule 132(2) of its — having regard to Rule 112 and Rule Rules of Procedure, 132(2) of its Rules of Procedure,

Or. en

Amendment 14 Sophia in 't Veld

Draft motion for a resolution Citation 20 a (new)

Draft motion for a resolution Amendment

— Having regard to Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by Member States of the Commission’s exercise of implementing powers;

Or. en

Amendment 15 Moritz Körner, Michal Šimečka, Jan-Christoph Oetjen, Sophia in 't Veld, Olivier Chastel

Draft motion for a resolution Citation 21 a (new)

PE691.441v01-00 8/88 AM\1229955EN.docx EN Draft motion for a resolution Amendment

— having regard to the EPRS briefing IDA 690536 on the EU-UK private-sector data flows after Brexit,

Or. en

Amendment 16 Cornelia Ernst

Draft motion for a resolution Recital A

Draft motion for a resolution Amendment

A. whereas the ability to transfer deleted personal data across borders has the potential to be a key driver of innovation, productivity and economic competitiveness;

Or. en

Amendment 17 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Recital A

Draft motion for a resolution Amendment

A. whereas the ability to transfer A. whereas the ability to transfer personal data across borders has the personal data across borders has the potential to be a key driver of innovation, potential to be a key driver of innovation, productivity and economic productivity and economic competitiveness; competitiveness, and is of crucial importance for effective cooperation in the fight against cross-border organised and serious crime as well as terrorism, which increasingly depends on the exchange of personal data;

Or. en

AM\1229955EN.docx 9/88 PE691.441v01-00 EN Amendment 18 Assita Kanko

Draft motion for a resolution Recital A

Draft motion for a resolution Amendment

A. whereas the ability to transfer A. whereas the ability to transfer personal data across borders has the personal data across borders is a key driver potential to be a key driver of innovation, of innovation, productivity and economic productivity and economic competitiveness and facilitates competitiveness; interpersonal contact and cultural relations;

Or. en

Amendment 19 Gwendoline Delbos-Corfield

Draft motion for a resolution Recital A

Draft motion for a resolution Amendment

A. whereas the ability to transfer A. whereas the ability to transfer personal data across borders has the personal data across borders in full respect potential to be a key driver of innovation, of fundamental rights has the potential to productivity and economic be a key driver of innovation, productivity competitiveness; and economic competitiveness;

Or. en

Amendment 20 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Recital A a (new)

Draft motion for a resolution Amendment

A a. whereas the UK has traditionally been an important trading partner of many EU Member States as well as a close ally in the area of security; whereas the EU and the UK should maintain this

PE691.441v01-00 10/88 AM\1229955EN.docx EN close cooperation despite the UK withdrawal from the EU since this will be beneficial for both sides whereas secure data transfers to the UK are not only important for our European businesses, but are crucial for effective cooperation in the fight against crime and terrorism as well;

Or. en

Amendment 21 Gwendoline Delbos-Corfield

Draft motion for a resolution Recital A a (new)

Draft motion for a resolution Amendment

A a. whereas dragnet mass surveillance by state actors is detrimental to the trust of European citizens in digital services and by extension to the digital economy;

Or. en

Amendment 22 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Recital A b (new)

Draft motion for a resolution Amendment

A b. whereas European businesses need legal clarity and certainty as the ability to transfer personal data across borders has become increasingly important for all types of companies that deliver goods and services internationally; whereas an adequacy decision concerning the UK under the GDPR is of utmost importance as many European businesses are conducting trade across the Channel, in particular given the fact that Brexit is still very recent and data flows within the

AM\1229955EN.docx 11/88 PE691.441v01-00 EN Union have not been subject to restrictions; whereas the failure to adopt any robust adequacy framework would risk disruptions in cross-border transfers of personal data as well as high compliance costs;

Or. en

Amendment 23 Gwendoline Delbos-Corfield

Draft motion for a resolution Recital A b (new)

Draft motion for a resolution Amendment

A b. Whereas the Court of Justice of the EU in the “Schrems I” judgment pointed out that indiscriminate access by intelligence authorities to the content of electronic communications violates the essence of the right to confidentiality of communications as provided in Article 7 of the Charter;

Or. en

Amendment 24 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Recital A c (new)

Draft motion for a resolution Amendment

A c. whereas the Trade and Cooperation Agreement (TCA) includes a number of safeguards and conditions to exchange relevant data in the law- enforcement context; whereas the the negotiations on personal data flows were conducted in parallel to the negotiations on the TCA but were not finalised by the end of the transition period on 31 December 2020; whereas a ‘bridging

PE691.441v01-00 12/88 AM\1229955EN.docx EN clause’ was included in the TCA as an interim solution, conditional upon the commitment by the UK not to change its current data protection regime, to ensure the continuation of data flows between the EEA and the EU until the adoption of an adequacy decision; whereas the initial four month period has been extended and will expire at the end of June 2021;

Or. en

Amendment 25 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Recital A d (new)

Draft motion for a resolution Amendment

A d. whereas the Commission on 19 February 2021 launched the procedure for the adoption of two adequacy decisions for transfers of personal data to the UK under the GDPR and the LED; whereas the UK has deemed the EU level of data protection to be adequate in accordance with its national law;

Or. en

Amendment 26 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Recital A e (new)

Draft motion for a resolution Amendment

A e. whereas the Commission currently recognises twelve third countries as providing adequate protection under the GDPR and has recently concluded talks with the Republic of Korea in this regard; whereas the UK would be the first country concerning which the Commission

AM\1229955EN.docx 13/88 PE691.441v01-00 EN proposes to grant adequacy under the Law Enforcement Directive;

Or. en

Amendment 27 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Recital A f (new)

Draft motion for a resolution Amendment

A f. whereas the case of the UK is distinct from all previous adequacy assessments as it concerns a former EU Member State which has fully incorporated the provisions of the GDPR in its national law and has moreover provided that all “EU-derived domestic legislation”, including the legislation transposing the Law Enforcement Directive, will continue to apply after the end of the transition period;

Or. en

Amendment 28 Assita Kanko

Draft motion for a resolution Recital B

Draft motion for a resolution Amendment

B. whereas in its Schrems I deleted judgment, the CJEU pointed out that indiscriminate access by intelligence authorities to the content of electronic communications violates Article 7 of the Charter, and that the United States do not provide sufficient legal remedies for non- US persons against mass surveillance, in violation of Article 47 of the Charter;

Or. en

PE691.441v01-00 14/88 AM\1229955EN.docx EN Amendment 29 Moritz Körner, Michal Šimečka, Jan-Christoph Oetjen, Sophia in 't Veld, Olivier Chastel

Draft motion for a resolution Recital B

Draft motion for a resolution Amendment

B. whereas in its Schrems I judgment, B. whereas in its Schrems I judgment, the CJEU pointed out that indiscriminate the CJEU pointed out that indiscriminate access by intelligence authorities to the access by intelligence authorities to the content of electronic communications content of electronic communications violates Article 7 of the Charter, and that violates Article 7 of the Charter; the United States do not provide sufficient legal remedies for non-US persons against mass surveillance, in violation of Article 47 of the Charter;

Or. en

Amendment 30 Juan Fernando López Aguilar, Gwendoline Delbos-Corfield, Moritz Körner, Cornelia Ernst, Marina Kaljurand

Draft motion for a resolution Recital B a (new)

Draft motion for a resolution Amendment

B a. whereas the assessment carried out by the European Commission before presenting its draft implementing decision is not complete, nor fully in line with the CJEU requirements for adequacy assessments, which was highlighted by the EDPB in its adequacy opinions, where it recommends the European Commission to further assess specific elements of UK law or practice relating to bulk collection, overseas disclosure and international agreements in the field of intelligence sharing, further use of the information collected for law enforcement purposes, independence of judicial commissioners;

AM\1229955EN.docx 15/88 PE691.441v01-00 EN Or. en

Amendment 31 Sophia in 't Veld

Draft motion for a resolution Recital B a (new)

Draft motion for a resolution Amendment

B a. whereas Regulation 2016/679 and Directive 2016/680 confer on the Commission implementing powers to declare that a third country or international organisation ensures an adequate level of protection, which should be exercised in accordance with Regulation 182/2011; whereas when presenting a draft implementing act the Commission must not exceed the implementing powers provided for in the basic act and must ensure that this is consistent with Union law, taking into account the rights relating to the review of the legality of Union acts;

Or. en

Amendment 32 Katarina Barley, Marina Kaljurand

Draft motion for a resolution Recital B a (new)

Draft motion for a resolution Amendment

B a. whereas the recommendations of the EDPB to the Commission include to closely monitor evolutions of the level of protection of EU personal data transferred to the UK from the entry into force of the adequacy decision, and, if necessary, consider amending the adequacy decision to introduce specific safeguards for data transferred from the EU, and/or to suspend the adequacy

PE691.441v01-00 16/88 AM\1229955EN.docx EN decision;

Or. en

Amendment 33 Assita Kanko

Draft motion for a resolution Recital B a (new)

Draft motion for a resolution Amendment

B a. whereas the UK was a Member State of the EU until 31 January 2020 and for decades involved in the shaping and adoption of EU data protection law; whereas during the transition period until 31 December 2020, the UK continued to be bound by EU legislation and subject to EU legal oversight;

Or. en

Amendment 34 Cornelia Ernst

Draft motion for a resolution Recital B a (new)

Draft motion for a resolution Amendment

B a. whereas the UK is a signatory to the European Convention on Human Rights (ECHR) and the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data;

Or. en

Amendment 35 Juan Fernando López Aguilar, Gwendoline Delbos-Corfield, Moritz Körner, Cornelia Ernst, Marina Kaljurand

AM\1229955EN.docx 17/88 PE691.441v01-00 EN Draft motion for a resolution Recital B b (new)

Draft motion for a resolution Amendment

B b. whereas certain aspects of UK law and/or practice have not been considered by the European Commission, which has led which has led to draft implementing decisions which are not consistent with Union law; whereas GDPR Art 45 reads that when assessing the adequacy of the level of protection, the Commission shall, in particular, take account of "(...) relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of suchlegislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law (...)", and "(...) the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data", which includes international agreements in other areas involving access to data or information sharing, and therefore requires an assessment of such international agreements;

Or. en

Amendment 36 Assita Kanko

Draft motion for a resolution Recital B b (new)

PE691.441v01-00 18/88 AM\1229955EN.docx EN Draft motion for a resolution Amendment

B b. whereas in the UK, the processing of data is governed by the so-called “UK GDPR” and the Data Protection Act 2018, which are based on the EU GDPR and the LED and provide similar safeguards, individual rights, obligations for controllers and processors, rules on international transfers, supervision system and redress avenues to those available under EU law;

Or. en

Amendment 37 Juan Fernando López Aguilar, Gwendoline Delbos-Corfield, Moritz Körner, Cornelia Ernst, Marina Kaljurand

Draft motion for a resolution Recital B c (new)

Draft motion for a resolution Amendment

B c. whereas the CJEU clearly stated in its Schrems I ruling that " (...) when examining the level of protection afforded by a thirdcountry, the Commission is obliged to assess the content of the applicable rules in that country resulting from its domestic law or international commitments and the practice designed to ensure compliance with those rules,since it must, under Article 25(2) of Directive 95/46, take account of all the circumstances surrounding a transfer of personal data to a third country"(CJEU Judgment of 6 October 2015 in case C- 362/14, paragraph 75);

Or. en

Amendment 38 Assita Kanko

AM\1229955EN.docx 19/88 PE691.441v01-00 EN Draft motion for a resolution Recital B c (new)

Draft motion for a resolution Amendment

B c. whereas agreed standards, a legal framework, and formalised review and suspension mechanisms provide important legal clarity and protection for the exchange of data to a third country; and avoids a legal vacuum;

Or. en

Amendment 39 Assita Kanko

Draft motion for a resolution Recital B d (new)

Draft motion for a resolution Amendment

B d. whereas data flows between the European Economic Area and the UK continue and remain safe thanks to a conditional interim regime that was agreed in the EU-UK Trade and Cooperation Agreement; whereas interim period expires on 30 June 2021, therefore, stresses the need to find a solution as soon as possible in order to avoid a legal vacuum;

Or. en

Amendment 40 Juan Fernando López Aguilar, Gwendoline Delbos-Corfield, Moritz Körner, Cornelia Ernst, Marina Kaljurand

Draft motion for a resolution Recital B d (new)

Draft motion for a resolution Amendment

B d. whereas intelligence services activities and sharing with third countries

PE691.441v01-00 20/88 AM\1229955EN.docx EN are excluded from the scope of EU law as per the Treaties when it comes to Member States, these are in the scope of the necessary adequacy assessment of the level of personal data offered by third countries, as confirmed by the CJEU in Schrems I and II rulings;

Or. en

Amendment 41 Assita Kanko

Draft motion for a resolution Recital B e (new)

Draft motion for a resolution Amendment

B e. whereas the European Commission has carefully assessed the UK's law and practice on personal data protection, including the rules on access to data by public authorities and has concluded that the UK ensures an essentially equivalent level of protection to the one guaranteed under the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED);

Or. en

Amendment 42 Juan Fernando López Aguilar, Gwendoline Delbos-Corfield, Moritz Körner, Cornelia Ernst, Marina Kaljurand

Draft motion for a resolution Recital B e (new)

Draft motion for a resolution Amendment

B e. whereas data protection standards rely not only on the legislation in place, but also the application of those laws in practice, and whereas the Commission has only assessed the legislation, but not the actual application in practice, when

AM\1229955EN.docx 21/88 PE691.441v01-00 EN preparing its decision;

Or. en

Amendment 43 Cornelia Ernst

Draft motion for a resolution Paragraph 1

Draft motion for a resolution Amendment

1. Notes that the UK is a signatory to deleted the European Convention on Human Rights (ECHR) and the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data; expects the UK to ensure the same minimum framework of data protection, despite having left the European Union;

Or. en

Amendment 44 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 1

Draft motion for a resolution Amendment

1. Notes that the UK is a signatory to 1. Welcomes that the UK has the European Convention on Human incorporated all provisions of the GDPR Rights (ECHR) and the Council of Europe into its national law and that the national Convention for the Protection of legislation transposing the EU Law Individuals with regard to Automatic Enforcement Directive continues to apply; Processing of Personal Data; expects the highlights, moreover, that the UK is a UK to ensure the same minimum signatory to the European Convention on framework of data protection, despite Human Rights (ECHR) and the Council of having left the European Union; Europe Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, as well to its amending protocol, the so-called ‘Convention 108+’; expects the UK to fully comply with its obligations under

PE691.441v01-00 22/88 AM\1229955EN.docx EN these international Treaties;

Or. en

Amendment 45 Assita Kanko

Draft motion for a resolution Paragraph 1

Draft motion for a resolution Amendment

1. Notes that the UK is a signatory to 1. Recalls that the UK is a signatory the European Convention on Human to the European Convention on Human Rights (ECHR) and the Council of Europe Rights (ECHR) and the Council of Europe Convention for the Protection of Convention for the Protection of Individuals with regard to Automatic Individuals with regard to Automatic Processing of Personal Data; expects the Processing of Personal Data; expects the UK to ensure the same minimum UK to ensure the same minimum framework of data protection, despite framework of data protection, despite having left the European Union; having left the European Union;

Or. en

Amendment 46 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 1 a (new)

Draft motion for a resolution Amendment

1 a. Welcomes the assessment of the European Data Protection Board (EDPB) which recognises that the UK has mirrored, for the most part, the GDPR in its data protection framework and that the EDPB has identified many aspects to be essentially equivalent;

Or. en

Amendment 47 Cornelia Ernst

AM\1229955EN.docx 23/88 PE691.441v01-00 EN Draft motion for a resolution Paragraph 2

Draft motion for a resolution Amendment

2. Welcomes the UK’s commitment to 2. Welcomes the UK’s commitment to respect democracy and the rule of law, and respect democracy and the rule of law, and protect and give domestic effect to protect and give domestic effect to fundamental rights such as those set out in fundamental rights such as those set out in the ECHR, including high levels of data the ECHR, including high levels of data protection; recalls that this is a necessary protection; recalls that this is a necessary precondition for the EU’s cooperation with precondition for the EU’s cooperation with the UK; recalls that despite Article 8 of the the UK; recalls that despite Article 8 of the ECHR on the right to privacy being part of ECHR on the right to privacy being part of UK domestic law via the Human Rights UK domestic law via the Human Rights Act 1998 and common law via the new tort Act 1998 and common law via the new tort of misuse of privacy information, efforts to of misuse of privacy information, efforts to include a fundamental right to data include a fundamental right to data protection were voted down by the protection were voted down by the government; government; is concerned that the UK has left the jurisdiction of the EU Charter of Fundamental Rights;

Or. en

Amendment 48 Assita Kanko

Draft motion for a resolution Paragraph 2

Draft motion for a resolution Amendment

2. Welcomes the UK’s commitment to 2. Welcomes the UK’s commitment to respect democracy and the rule of law, and respect democracy and the rule of law, and protect and give domestic effect to protect and give domestic effect to fundamental rights such as those set out in fundamental rights such as those set out in the ECHR, including high levels of data the ECHR, including high levels of data protection; recalls that this is a necessary protection; recalls that despite Article 8 of precondition for the EU’s cooperation the ECHR on the right to privacy being with the UK; recalls that despite Article 8 part of UK domestic law via the Human of the ECHR on the right to privacy being Rights Act 1998 and common law via the part of UK domestic law via the Human new tort of misuse of privacy information, Rights Act 1998 and common law via the efforts to include a fundamental right to new tort of misuse of privacy information, data protection were voted down by the efforts to include a fundamental right to government; data protection were voted down by the

PE691.441v01-00 24/88 AM\1229955EN.docx EN government;

Or. en

Amendment 49 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 2

Draft motion for a resolution Amendment

2. Welcomes the UK’s commitment to 2. Welcomes the UK’s commitment to respect democracy and the rule of law, and respect democracy and the rule of law, and protect and give domestic effect to to protect and give domestic effect to fundamental rights such as those set out in fundamental rights such as those set out in the ECHR, including high levels of data the ECHR, including high levels of data protection; recalls that this is a necessary protection; recalls that this is a necessary precondition for the EU’s cooperation with precondition for the EU’s cooperation with the UK; recalls that despite Article 8 of the the UK; recalls that despite Article 8 of the ECHR on the right to privacy being part of ECHR on the right to privacy being part of UK domestic law via the Human Rights UK domestic law via the Human Rights Act 1998 and common law via the new tort Act 1998 and common law via the new tort of misuse of privacy information, efforts to of misuse of privacy information, efforts to include a fundamental right to data include a fundamental right to data protection were voted down by the protection were voted down by the government; government;

Or. en

Amendment 50 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 3

Draft motion for a resolution Amendment

3. Is concerned about public 3. Is aware of public statements by statements by the UK Prime Minister the UK Prime Minister declaring that UK declaring that UK will seek to diverge from will seek to diverge from EU data EU data protection rules and establish its protection rules and establish its own own ‘sovereign’ controls in this field; ‘sovereign’ controls in this field; stresses, considers that the 2020 UK National Data however, that so far no legislative action Strategy represents a shift from the has been taken on these political protection of personal data towards a wider declarations; considers that the 2020 UK

AM\1229955EN.docx 25/88 PE691.441v01-00 EN use and sharing of data that is incompatible National Data Strategy represents a shift with the principles of fairness, data from the protection of personal data minimisation and purpose limitation under towards a wider use and sharing of data the GDPR; that could have an impact on the principles of fairness, data minimisation and purpose limitation set out in the GDPR and mirrored in the UK GDPR, although it aims to maintain high data protection standards; notes that the Strategy emphasises the commitment of the UK to obtain an adequacy decision from the EU and to ensure that the free flow of data to and from the UK to global partners is properly protected;

Or. en

Amendment 51 Sophia in 't Veld

Draft motion for a resolution Paragraph 3

Draft motion for a resolution Amendment

3. Is concerned about public 3. Points out that the EU has opted statements by the UK Prime Minister for a human rights centric approach to declaring that UK will seek to diverge from data governance in developing robust data EU data protection rules and establish its protection rules within the GDPR, and is own ‘sovereign’ controls in this field; therefore deeply concerned about public considers that the 2020 UK National Data statements by the UK Prime Minister Strategy represents a shift from the declaring that UK will seek to diverge from protection of personal data towards a wider EU data protection rules and establish its use and sharing of data that is incompatible own ‘sovereign’ controls in this field; with the principles of fairness, data considers that the 2020 UK National Data minimisation and purpose limitation under Strategy represents a shift from the the GDPR; protection of personal data towards a wider use and sharing of data that is incompatible with the principles of fairness, data minimisation and purpose limitation under the GDPR;

Or. en

Amendment 52 Katarina Barley, Marina Kaljurand

PE691.441v01-00 26/88 AM\1229955EN.docx EN Draft motion for a resolution Paragraph 3

Draft motion for a resolution Amendment

3. Is concerned about public 3. Is concerned about public statements by the UK Prime Minister statements by the UK Prime Minister declaring that UK will seek to diverge from declaring that UK will seek to diverge from EU data protection rules and establish its EU data protection rules and establish its own ‘sovereign’ controls in this field; own ‘sovereign’ controls in this field; considers that the 2020 UK National Data considers that the 2020 UK National Data Strategy represents a shift from the Strategy represents a shift from the protection of personal data towards a wider protection of personal data towards a wider use and sharing of data that is incompatible use and sharing of data that is incompatible with the principles of fairness, data with the principles of fairness, data minimisation and purpose limitation under minimisation and purpose limitation under the GDPR; the GDPR; notes that the EDPB highlights that this might lead to possible risks in the protection provided to personal data transferred from the EU;

Or. en

Amendment 53 Assita Kanko

Draft motion for a resolution Paragraph 3

Draft motion for a resolution Amendment

3. Is concerned about public 3. Notes public statements by the UK statements by the UK Prime Minister Prime Minister declaring that the UK declaring that UK will seek to diverge will establish its own sovereign controls in from EU data protection rules and the area of data protection; considers that establish its own ‘sovereign’ controls in the 2020 UK National Data Strategy could this field; considers that the 2020 UK represent a shift from the protection of National Data Strategy represents a shift personal data towards a wider use and from the protection of personal data sharing of data; underlines that it is towards a wider use and sharing of data important to monitor any legislative that is incompatible with the principles of changes based on the Strategy and assess fairness, data minimisation and purpose their compatibility with the GDPR; limitation under the GDPR;

Or. en

AM\1229955EN.docx 27/88 PE691.441v01-00 EN Amendment 54 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 3 a (new)

Draft motion for a resolution Amendment

3 a. Is concerned that the UK has left the jurisdiction of the EU Charter of Fundamental Rights; reminds that the current state is that 'references to the Charter in any case law are, so far as necessary for this purpose, to be read as if they were references to any corresponding retained fundamental rights or principles'; reminds however that the UK does not recognise a domestic fundamental right to privacy in the common law, and that in the passage of the data protection act, efforts to include a fundamental right to data protection were voted down by the Government; recognises that the UK recognises the European Convention on Human Rights, but points out that the European Court of Human Rights has not interpreted restrictions on data transfers in the same way as the CJEU;

Or. en

Amendment 55 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 3 a (new)

Draft motion for a resolution Amendment

3 a. Notes that UK legislation, notably the Digital Economy Act 2017 and the Crime and Courts Act, explicitly allow “onward sharing” of personal data between public authorities and with the National Crime Agency respectively for several specified purposes; underlines that onward sharing on the basis of these

PE691.441v01-00 28/88 AM\1229955EN.docx EN acts has to comply with the rights and principles defined in the UK Data Protection Act; shares the view of the EDPB that the Commission should further assess the possible impact of related restrictions to the level of protection of personal data;

Or. en

Amendment 56 Sophia in 't Veld

Draft motion for a resolution Paragraph 3 a (new)

Draft motion for a resolution Amendment

3 a. Points out that data protection standards rely not only on the legislation in place, but also on the application of those laws in practice; regrets that the Commission has only assessed the legislation, but not the actual application in practice;

Or. en

Amendment 57 Cornelia Ernst

Draft motion for a resolution Paragraph 3 a (new)

Draft motion for a resolution Amendment

3 a. Underlines that any future adequacy decision from the Commission should not rely on a system of self- certification, as it was the case with Safe Harbour and the Privacy Shield. Notes that adequacy decisions should never be political decisions.

Or. en

AM\1229955EN.docx 29/88 PE691.441v01-00 EN Amendment 58 Sophia in 't Veld

Draft motion for a resolution Paragraph 3 b (new)

Draft motion for a resolution Amendment

3 b. Points out that valid adequacy decisions greatly contribute to the protection of fundamental rights of citizens and legal certainty for companies; stresses however that adequacy decisions based on incomplete assessments and without proper enforcement by the Commission, may lead to the opposite when challenged in court;

Or. en

Amendment 59 Sophia in 't Veld

Draft motion for a resolution Paragraph 3 c (new)

Draft motion for a resolution Amendment

3 c. Points out that the assessment carried out by the Commission before presenting its draft implementing decision is not complete, nor fully in line with the CJEU requirements for adequacy assessments, which was highlighted by the EDPB in its adequacy opinions, where it recommends the Commission to further assess specific elements of UK law or practice relating to bulk collection, overseas disclosure and international agreements in the field of intelligence sharing, further use of the information collected for law enforcement purposes, and independence of judicial commissioners;

Or. en

PE691.441v01-00 30/88 AM\1229955EN.docx EN Amendment 60 Gwendoline Delbos-Corfield

Draft motion for a resolution Subheading 3

Draft motion for a resolution Amendment

Enforcement of the GDPR The UK’s new approach to data protection

Or. en

Amendment 61 Assita Kanko

Draft motion for a resolution Paragraph 4

Draft motion for a resolution Amendment

4. Expresses its concern about the deleted lack and sometimes non-existent enforcement of the GDPR by the UK when it was still a member of the EU; points to the lack of proper enforcement by the UK Information Commissioner’s Office in the past;

Or. en

Amendment 62 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 4

Draft motion for a resolution Amendment

4. Expresses its concern about the lack 4. Expresses its concern about the lack and sometimes non-existent enforcement and sometimes non-existent enforcement of the GDPR by the UK when it was still a of the GDPR by the UK when it was still a member of the EU; points to the lack of member of the EU; points to the lack of proper enforcement by the UK Information proper enforcement by the UK Information Commissioner’s Office in the past; points

AM\1229955EN.docx 31/88 PE691.441v01-00 EN Commissioner’s Office in the past; to the example of the Information Commissioner (ICO) closing a complaint into adtech after holding two stakeholder events, writing a report (the 'Update Report on Adtech') and stating that “the adtech industry appears immature in its understanding of data protection requirements”, but having used none of their enforcement powers;1a is concerned that this non-enforcement is a structural problem, which is laid out in the ICO’s 'Regulatory Action Policy’, which explicitly states that "In the majority of cases we will reserve our powers for the most serious cases, representing the most severe breaches of information rights obligations. These will typically involve wilful, deliberate or negligent acts, or repeated breaches of information rights obligations, causing harm or damage to individuals"1b; underlines that in practice, this has meant that routine breaches of data protection law have not been remedied; ______1a https://techcrunch.com/2020/11/05/uks- ico-faces-legal-action-after-closing- adtech-complaint-with-nothing-to-show- for-it/ 1b https://ico.org.uk/media/about-the- ico/documents/2259467/regulatory- action-policy.pdf

Or. en

Amendment 63 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 4

Draft motion for a resolution Amendment

4. Expresses its concern about the 4. Recalls the EDPB assessment lack and sometimes non-existent regarding the existence and effective enforcement of the GDPR by the UK when functioning of an independent it was still a member of the EU; points to supervisory authority in the UK;

PE691.441v01-00 32/88 AM\1229955EN.docx EN the lack of proper enforcement by the UK underlines that the Information Information Commissioner’s Office in the Commissioner’s Office (ICO) is a well- past; equipped and active data protection authority which already had enforcement powers before the GDPR was in place and imposed significant fines under the GDPR when it was still a member of the EU; points to the importance of proper enforcement by the UK Information Commissioner’s Office and stresses that the UK should ensure that the ICO maintains a high level of expertise and resources so it can properly enforce the UK data protection framework;

Or. en

Amendment 64 Cornelia Ernst

Draft motion for a resolution Paragraph 4

Draft motion for a resolution Amendment

4. Expresses its concern about the lack 4. Expresses its concern about the lack and sometimes non-existent enforcement and often non-existent enforcement of the of the GDPR by the UK when it was still a GDPR by the UK when it was still a member of the EU; points to the lack of member of the EU; in particular points to proper enforcement by the UK Information the lack of proper enforcement by the UK Commissioner’s Office in the past; Information Commissioner’s Office in the past; underlines the fact that a large number of data protection law breaches in the UK therefore have not been remedied

Or. en

Amendment 65 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 4 a (new)

Draft motion for a resolution Amendment

4 a. Takes note of the UK “National

AM\1229955EN.docx 33/88 PE691.441v01-00 EN Data Strategy”, as updated on 9.12.20201a, which indicates a turn from the protection of personal data towards more and wider use and sharing of data; points out that a position of “withholding data can negatively impact society“, as indicated in the strategy, is not compatible with the principles of data minimisation and purpose limitation under the GDPR and primary law; ______1a https://www.gov.uk/government/publicatio ns/uk-national-data-strategy/national- data-strategy

Or. en

Amendment 66 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 4 b (new)

Draft motion for a resolution Amendment

4 b. Takes note of a recent op-ed by Secretary of State for Digital, Culture, Media and Sport, Oliver Dowden, where he claimed that the “next Information Commissioner will not just be asked to focus on privacy, but also be empowered to ensure people can use data to achieve economic and social goals”, and that the appointment of the new ICO “will mark the beginning of a new era in the UK — one where we start asking ourselves not just whether we have the right to use data, but whether, given its potential for good, we have the right not to”1a; is strongly concerned that this “new era” will deviate from the principles enshrined in EU primary law and its data protection acquis, including data minimisation and purpose limitation; ______

PE691.441v01-00 34/88 AM\1229955EN.docx EN 1a https://www.ft.com/content/ac1cbaef- d8bf-49b4-b11d-1fcc96dde0e1

Or. en

Amendment 67 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 4 c (new)

Draft motion for a resolution Amendment

4 c. Is equally concerned about the job advert for the next UK Information Commissioner, which requires “experience of using data to drive innovation and growth, in industry, research or a scientific field”, and “commercial and business acumen, including an understanding of how the data protection regulatory environment impacts on business and how to help them”1a; notes that the job advert lacks criteria relating to the ability to deliver effective regulation of data protection and legal compliance, other than a ‘knowledge’ of data protection; reminds that Article 53 of the GDPR requires “qualifications, experience and skills, in particular in the area of the protection of personal data”; is worried that the job advert prioritises enabling innovation over protecting fundamental rights; ______1a https://publicappointments.cabinetoffice.g ov.uk/appointment/information- commissioner-2/

Or. en

Amendment 68 Gwendoline Delbos-Corfield

AM\1229955EN.docx 35/88 PE691.441v01-00 EN Draft motion for a resolution Paragraph 4 d (new)

Draft motion for a resolution Amendment

4 d. Takes note that the Constitutional Affairs Committee in 20041a and the Public Affairs Committee of the UK Parliament in 20141b recommended to secure the independence of the Commissioner through making them an Officer of Parliament, reporting to Parliament, rather than continuing to be appointed by the Minister for Digital Media and Sport; regrets that this has not been followed up upon; ______1a Constitutional Affairs Seventh Report, published by House of Common 13 June 200 available at https://publications.parliament.uk/pa/cm2 00506/cmselect/cmconst/991/99109.htm#a 22%2044 Paragraph 108 “We see considerable merit in the Information Commissioner becoming directly responsible to, and funded by, Parliament, and recommend that such a change be considered when an opportunity arises to amend the legislation” 1b Who's accountable? Relationships between Government and arm's-length bodies, Report of the Public Administration Committee, published by House of Commons 4 November 2014, available atttps://publications.parliament.uk/pa/cm 201415/cmselect/cmpubadm/110/11009.ht m Paragraph 64 “The Information Commissioner and HM Inspectorate of Prisons should be more fully independent of Government and should report to Parliament. The Information Commissioner, Commissioner for Public Appointments and the Chair of the Committee on Standards in Public Life should become Officers of Parliament, as the Parliamentary and Health Service Ombudsman and the Comptroller and

PE691.441v01-00 36/88 AM\1229955EN.docx EN Auditor General already are.”

Or. en

Amendment 69 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 5

Draft motion for a resolution Amendment

5. Is concerned that UK data 5. Is concerned that UK immigration protection law contains a broad derogation uses a system that undertakes large-scale from aspects of the fundamental data data processing, deciding people’s right to protection principles, such as the right of remain in the country; notes that UK data access and the right of a data subject to protection law contains a broad derogation know with whom their data has been from aspects of the fundamental data shared, if such protection would ‘prejudice protection principles, such as the right of effective immigration control’15 ; points access and the right of a data subject to out that this exemption is available to all know with whom their data has been data controllers in the UK; is concerned shared, if such protection would ‘prejudice about the recently revealed information effective immigration control’15 ; points that the immigration exemption was used out that this exemption is available to all in over 70 % of data subject requests to the data controllers in the UK including local Home Office in 202016 ; authorities, health providers and private contractors involved in the immigration system; is concerned about the recently revealed information that the immigration exemption was used in over 70 % of data subject requests to the Home Office in 202016; underlines that monitoring and compliance of the use of the exemption must be carried out in line with standards required in the Adequacy Referential which require consideration of practice as well as principle, by pointing out that “it is necessary to consider not only the content of the rules applicable to personal data transferred to a third country… but also the system in place to ensure the effectiveness of such rules”; ______15 Schedule 2 of the Data Protection Act 15 Schedule 2 of the Data Protection Act 2018. 2018. 16 Open Rights Group press release of 3 16 Open Rights Group press release of 3 March 2021 entitled ‘Documents reveal March 2021 entitled ‘Documents reveal

AM\1229955EN.docx 37/88 PE691.441v01-00 EN controversial Immigration Exemption used controversial Immigration Exemption used in 70% of access requests to Home Office’. in 70% of access requests to Home Office’.

Or. en

Amendment 70 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 5

Draft motion for a resolution Amendment

5. Is concerned that UK data 5. Is concerned that UK data protection law contains a broad derogation protection law contains a derogation from from aspects of the fundamental data certain data protection rights, such as the protection principles, such as the right of right of access and the right of a data access and the right of a data subject to subject to know with whom their data has know with whom their data has been been shared, if such protection would shared, if such protection would ‘prejudice ‘prejudice effective immigration control’15; effective immigration control’15 ; points recognises that this exemption, which is out that this exemption is available to all available to all data controllers in the UK, data controllers in the UK; is concerned has been endorsed by the ICO and a about the recently revealed information Court and can only be invoked on a case- that the immigration exemption was used by-case basis and applied in a necessary in over 70 % of data subject requests to the and proportionate way; recalls recently Home Office in 202016 ; revealed information whereby 17,780 access requests were made in relation to data processed concerning 146.75 million data subjects and that the immigration exemption was used in over 70 % of data subject requests to the Home Office in 202016 ; stresses that even in those cases where the Home Office made use of the derogation, access to information was not completely denied but restricted to redacted documents; ______15 Schedule 2 of the Data Protection Act 15 Schedule 2 of the Data Protection Act 2018. 2018. 16 Open Rights Group press release of 3 16 Open Rights Group press release of 3 March 2021 entitled ‘Documents reveal March 2021 entitled ‘Documents reveal controversial Immigration Exemption used controversial Immigration Exemption used in 70% of access requests to Home Office’. in 70% of access requests to Home Office’.

Or. en

PE691.441v01-00 38/88 AM\1229955EN.docx EN Amendment 71 Sophia in 't Veld

Draft motion for a resolution Paragraph 5

Draft motion for a resolution Amendment

5. Is concerned that UK data 5. Is concerned that UK data protection law contains a broad derogation protection law contains a broad derogation from aspects of the fundamental data from aspects of the fundamental data protection principles, such as the right of protection principles, such as the right of access and the right of a data subject to access and the right of a data subject to know with whom their data has been know with whom their data has been shared, if such protection would ‘prejudice shared, if such protection would ‘prejudice effective immigration control’15 ; points effective immigration control’15 ; points out that this exemption is available to all out that this exemption is available to all data controllers in the UK; is concerned data controllers in the UK; is concerned about the recently revealed information about the recently revealed information that the immigration exemption was used that the immigration exemption was used in over 70 % of data subject requests to the in over 70 % of data subject requests to the Home Office in 202016 ; Home Office in 202016 ; stresses that this derogation was not in line with the GDPR when the UK was still a Member, and ignored by the Commission in its role as Guardian of the Treaties; underlines that the EDPB concluded in its opinion that further clarifications on the application of the immigration exemption are needed; ______15 Schedule 2 of the Data Protection Act 15 Schedule 2 of the Data Protection Act 2018. 2018. 16 Open Rights Group press release of 3 16 Open Rights Group press release of 3 March 2021 entitled ‘Documents reveal March 2021 entitled ‘Documents reveal controversial Immigration Exemption used controversial Immigration Exemption used in 70% of access requests to Home Office’. in 70% of access requests to Home Office’.

Or. en

Amendment 72 Cornelia Ernst

Draft motion for a resolution Paragraph 5

AM\1229955EN.docx 39/88 PE691.441v01-00 EN Draft motion for a resolution Amendment

5. Is concerned that UK data 5. Is concerned that UK data protection law contains a broad derogation protection law contains a broad derogation from aspects of the fundamental data from aspects of the fundamental data protection principles, such as the right of protection rights and principles, such as access and the right of a data subject to the right of access and the right of a data know with whom their data has been subject to know with whom their data has shared, if such protection would ‘prejudice been shared, if such protection would effective immigration control’15 ; points ‘prejudice effective immigration control’15 out that this exemption is available to all ; points out that this exemption is available data controllers in the UK; is concerned to all data controllers in the UK; is about the recently revealed information concerned about the recently revealed that the immigration exemption was used information that the immigration in over 70 % of data subject requests to the exemption was used in over 70 % of data Home Office in 202016 ; subject requests to the Home Office in 202016 ; ______15 Schedule 2 of the Data Protection Act 15 Schedule 2 of the Data Protection Act 2018. 2018. 16 Open Rights Group press release of 3 16 Open Rights Group press release of 3 March 2021 entitled ‘Documents reveal March 2021 entitled ‘Documents reveal controversial Immigration Exemption used controversial Immigration Exemption used in 70% of access requests to Home Office’. in 70% of access requests to Home Office’.

Or. en

Amendment 73 Assita Kanko

Draft motion for a resolution Paragraph 5

Draft motion for a resolution Amendment

5. Is concerned that UK data 5. Is concerned that UK data protection law contains a broad derogation protection law contains a derogation from from aspects of the fundamental data aspects of the fundamental data protection protection principles, such as the right of principles, such as the right of access and access and the right of a data subject to the right of a data subject to know with know with whom their data has been whom their data has been shared, if such shared, if such protection would ‘prejudice protection would ‘prejudice effective effective immigration control’15 ; points immigration control’15 ; points out that this out that this exemption is available to all exemption is available to all data data controllers in the UK; is concerned controllers in the UK; is concerned about about the recently revealed information the recently revealed information that the that the immigration exemption was used immigration exemption was used in over

PE691.441v01-00 40/88 AM\1229955EN.docx EN in over 70 % of data subject requests to the 70 % of data subject requests to the Home Home Office in 202016 ; Office in 202016 ; ______15 Schedule 2 of the Data Protection Act 15 Schedule 2 of the Data Protection Act 2018. 2018. 16 Open Rights Group press release of 3 16 Open Rights Group press release of 3 March 2021 entitled ‘Documents reveal March 2021 entitled ‘Documents reveal controversial Immigration Exemption used controversial Immigration Exemption used in 70% of access requests to Home Office’. in 70% of access requests to Home Office’.

Or. en

Amendment 74 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 6

Draft motion for a resolution Amendment

6. Notes that this exception now 6. Notes that this exception, which applies to EU citizens who reside or plan can be challenged before the ICO and UK to reside in the UK; is strongly concerned Courts, may be invoked towards EU that the exemption removes key citizens who reside or plan to reside in the opportunities for accountability and UK; calls on the Commission to closely remedies; monitor the application of this exception to ensure that it does not remove key opportunities for accountability and remedies; calls on the Commission to ask safeguards in order to protect EU citizens against the possible use of this exemption in the future and to uphold the rights and remedies of EU citizens under the GDPR;

Or. en

Amendment 75 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 6

Draft motion for a resolution Amendment

6. Notes that this exception now 6. Notes that this exception now

AM\1229955EN.docx 41/88 PE691.441v01-00 EN applies to EU citizens who reside or plan to applies to EU citizens who reside or plan to reside in the UK; is strongly concerned that reside in the UK; is strongly concerned that the exemption removes key opportunities the exemption removes key opportunities for accountability and remedies; for accountability and remedies, and; underlines that this is not an adequate level of protection;

Or. en

Amendment 76 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 7

Draft motion for a resolution Amendment

7. Points out that it has repeatedly 7. Points out that it has repeatedly voiced its concern about an exception for voiced its concern about an exception for data subjects’ rights in the UK’s data subjects’ rights in the UK’s immigration policy, including in its immigration policy, including in its resolution of 12 February 2020 on the new resolution of 12 February 2020 on the new partnership with the UK17 and the opinion partnership with the UK17 and the opinion of the Committee on Civil Liberties, of the Committee on Civil Liberties, Justice and Home Affairs of February Justice and Home Affairs of 5 February 2021, which held that the exemption for 2021, which held that the exemption for the processing of personal data for the processing of personal data for immigration purposes of the UK Data immigration purposes of the UK Data Protection Act needed to be amended Protection Act needed to be amended before a valid adequacy decision could be before a valid adequacy decision could be reached18 ; reached18 ; ______17 Texts adopted, P9_TA(2020)0033. 17 Texts adopted, P9_TA(2020)0033. 18 Opinion of the Committee on Civil 18 Opinion of the Committee on Civil Liberties, Justice and Home Affairs on the Liberties, Justice and Home Affairs on the conclusion, on behalf of the Union, of the conclusion, on behalf of the Union, of the Trade and Cooperation Agreement Trade and Cooperation Agreement between the European Union and the between the European Union and the European Atomic Energy Community, of European Atomic Energy Community, of the one part, and the United Kingdom of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the Great Britain and Northern Ireland, of the other part, and of the Agreement between other part, and of the Agreement between the European Union and the United the European Union and the United Kingdom of Great Britain and Northern Kingdom of Great Britain and Northern Ireland concerning security procedures for Ireland concerning security procedures for exchanging and protecting classified exchanging and protecting classified

PE691.441v01-00 42/88 AM\1229955EN.docx EN information, LIBE_AL(2021)680848. information, LIBE_AL(2021)680848.

Or. en

Amendment 77 Sophia in 't Veld

Draft motion for a resolution Paragraph 7

Draft motion for a resolution Amendment

7. Points out that it has repeatedly 7. Reiterates its strong concern about voiced its concern about an exception for an exception for data subjects’ rights in the data subjects’ rights in the UK’s UK’s immigration policy; and reiterates immigration policy, including in its its position that the exemption for the resolution of 12 February 2020 on the new processing of personal data for partnership with the UK17 and the opinion immigration purposes of the UK Data of the Committee on Civil Liberties, Protection Act needs to be amended Justice and Home Affairs of February before a valid adequacy decision can be 2021, which held that the exemption for given, as repeatedly voiced in its resolution the processing of personal data for of 12 February 2020 on the new immigration purposes of the UK Data partnership with the UK17 and the opinion Protection Act needed to be amended of the Committee on Civil Liberties, before a valid adequacy decision could be Justice and Home Affairs of February reached18 ; 202118; ______17 Texts adopted, P9_TA(2020)0033. 17 Texts adopted, P9_TA(2020)0033. 18 Opinion of the Committee on Civil 18 Opinion of the Committee on Civil Liberties, Justice and Home Affairs on the Liberties, Justice and Home Affairs on the conclusion, on behalf of the Union, of the conclusion, on behalf of the Union, of the Trade and Cooperation Agreement Trade and Cooperation Agreement between the European Union and the between the European Union and the European Atomic Energy Community, of European Atomic Energy Community, of the one part, and the United Kingdom of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the Great Britain and Northern Ireland, of the other part, and of the Agreement between other part, and of the Agreement between the European Union and the United the European Union and the United Kingdom of Great Britain and Northern Kingdom of Great Britain and Northern Ireland concerning security procedures for Ireland concerning security procedures for exchanging and protecting classified exchanging and protecting classified information, LIBE_AL(2021)680848. information, LIBE_AL(2021)680848.

Or. en

AM\1229955EN.docx 43/88 PE691.441v01-00 EN Amendment 78 Marina Kaljurand, Katarina Barley

Draft motion for a resolution Paragraph 7 a (new)

Draft motion for a resolution Amendment

7 a. Notes the EDPB has invited the European Commission to take into account the appeal judgement of the proceedings Open Rights Group & Anor, R (On the Application Of) v Secretary of State for the Home Department & Anor [2019] EWHC 2562 (Admin) (03 October 2019), in the adequacy decision, and to provide further information on the necessity and proportionality of the immigration exemption.

Or. en

Amendment 79 Sophia in 't Veld

Draft motion for a resolution Paragraph 7 a (new)

Draft motion for a resolution Amendment

7 a. Regrets that the description of "secondary data" (metadata) fails to indicate that such data can be highly revealing and intrusive and are subject to sophisticated automated analyses, whereas UK law allows UK intelligence agencies to process these data in a way that does not meet Union case law;

Or. en

Amendment 80 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 8

PE691.441v01-00 44/88 AM\1229955EN.docx EN Draft motion for a resolution Amendment

8. Recalls the revelations of mass 8. Recalls the revelations of mass surveillance by the US and the UK, as surveillance by the US and the UK, as revealed by whistle-blower Edward revealed by whistle-blower Edward Snowden; recalls that the UK ‘Tempora’ Snowden; recalls that the European Court programme run by the Government for Human Rights (ECHR) in 2018 ruled Communications Headquarters (GCHQ) the UK’s mass data interception and intercepts communications in real time retention programmes, including the through fibre-optical internet backbone ‘Tempora’ programme run by the cables, and records the data so it can be Government Communications processed and searched at a later time; Headquarters (GCHQ) and used to intercept communications in real time through fibre-optical internet backbone cables, and record the data so they can be processed and searched at a later time, unlawful;

Or. en

Amendment 81 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 8

Draft motion for a resolution Amendment

8. Recalls the revelations of mass 8. Recalls the revelations of mass surveillance by the US and the UK, as surveillance by the US and the UK, as revealed by whistle-blower Edward revealed by whistle-blower Edward Snowden; recalls that the UK ‘Tempora’ Snowden; recalls that the UK ‘Tempora’ programme run by the Government programme run by the Government Communications Headquarters (GCHQ) Communications Headquarters (GCHQ) intercepts communications in real time intercepts communications in real time through fibre-optical internet backbone through fibre-optical internet backbone cables, and records the data so it can be cables, and records the data so it can be processed and searched at a later time; processed and searched at a later time; recalls that this mass surveillance of communications content and metadata takes place without any individual suspicion or targeting;

Or. en

AM\1229955EN.docx 45/88 PE691.441v01-00 EN Amendment 82 Assita Kanko

Draft motion for a resolution Paragraph 9

Draft motion for a resolution Amendment

9. Recalls its resolution of 12 March deleted 2014, which found that the indiscriminate and non-suspicion-based mass surveillance programmes conducted by the UK intelligence agency GCHQ are incompatible with the principles of necessity and proportionality in a democratic society and are not adequate under EU data protection law;

Or. en

Amendment 83 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 9

Draft motion for a resolution Amendment

9. Recalls its resolution of 12 March 9. Recalls furthermore its resolution 2014, which found that the indiscriminate of 12 March 2014, which found that the and non-suspicion-based mass surveillance indiscriminate and non-suspicion-based programmes conducted by the UK mass surveillance programmes conducted intelligence agency GCHQ are by the UK intelligence agency GCHQ are incompatible with the principles of incompatible with the principles of necessity and proportionality in a necessity and proportionality in a democratic society and are not adequate democratic society and are not adequate under EU data protection law; under EU data protection law; recognises, that the UK has since significantly reformed its surveillance laws and introduced safeguards which go beyond the conditions defined by the CJEU in its Schrems II ruling and which go beyond the safeguards provided in the surveillance laws of most Member States; welcomes in particular the provision of full access to effective judicial redress; reminds that the UN Rapporteur on the Right to Privacy has welcomed the strong

PE691.441v01-00 46/88 AM\1229955EN.docx EN safeguards introduced with the Investigatory Powers Act 2016 in terms of necessity, proportionality and independent authorisation by a judicial body;

Or. en

Amendment 84 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 9

Draft motion for a resolution Amendment

9. Recalls its resolution of 12 March 9. Reminds that in the judgments on 2014, which found that the indiscriminate “Schrems I / Safe Harbour” and and non-suspicion-based mass “Schrems II / Privacy Shield”, the CJEU surveillance programmes conducted by held that mass access to the content of the UK intelligence agency GCHQ are private communications touches upon the incompatible with the principles of essence of the right to privacy, and that in necessity and proportionality in a such cases, a necessity and proportionality democratic society and are not adequate test is not even needed any more; under EU data protection law; underlines that these principles apply to data transfers to other third countries than the US, including the United Kingdom;

Or. en

Amendment 85 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 9 a (new)

Draft motion for a resolution Amendment

9 a. Recalls its resolution of 12 March 2014, which found that the indiscriminate and non-suspicion-based mass surveillance programmes conducted by the UK intelligence agency GCHQ are incompatible with the principles of necessity and proportionality in a democratic society and are not adequate

AM\1229955EN.docx 47/88 PE691.441v01-00 EN under EU data protection law;

Or. en

Amendment 86 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 10

Draft motion for a resolution Amendment

10. Recalls that in September 2018, deleted the European Court of Human Rights confirmed that the UK’s mass data interception and retention programmes, including Tempora, were ‘unlawful and incompatible with the conditions necessary for a democratic society’19 ; ______19 Judgment of the European Court of Human Rights of 13 September 2018, Big Brother Watch and others v the United Kingdom, applications nos. 58170/13, 62322/14, 24960/15.

Or. en

Amendment 87 Assita Kanko

Draft motion for a resolution Paragraph 11

Draft motion for a resolution Amendment

11. Is concerned that the draft deleted adequacy decisions fail to take into account either the actual use of UK bulk data powers or UK-US surveillance operations; points out that furthermore, in relation to the US, UK citizens are subject to some informal safeguards between GCHQ and the National Security Agency (NSA); expresses deep concern

PE691.441v01-00 48/88 AM\1229955EN.docx EN that these safeguards would not protect EU citizens or residents whose data may be subject to onward transfers and sharing with the NSA;

Or. en

Amendment 88 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 11

Draft motion for a resolution Amendment

11. Is concerned that the draft adequacy 11. Is concerned that the draft adequacy decisions fail to take into account either decisions fail to take into account the the actual use of UK bulk data powers or actual use of UK bulk data powers or UK- UK-US surveillance operations; points out US surveillance operations as exposed by that furthermore, in relation to the US, UK Edward Snowden, including citizens are subject to some informal safeguards between GCHQ and the National Security Agency (NSA); expresses deep concern that these safeguards would not protect EU citizens or residents whose data may be subject to onward transfers and sharing with the NSA; a) that there is no effective substantive oversight by the ICO or the courts over the use of the national security exemption in UK data protection law; b) the limitations on the use of UK “bulk powers” are not set out in the law itself, as required by the CJEU (but rather, are left to executive discretion subject to “respectful” judicial control); c) the description of “secondary data” (metadata) in the Draft Decisions is seriously misleading and fails to note that such data can be highly revealing and intrusive and are subject to sophisticated automated analyses (as the CJEU found in Digital Rights Ireland), yet under UK law metadata are not meaningfully protected against undue access, bulk collection and AI-based analysis by the

AM\1229955EN.docx 49/88 PE691.441v01-00 EN UK intelligence agencies; d) the “5EYES” agencies, in particular, GCHQ and the NSA, who in practice share effectively all intelligence data; points out that furthermore, in relation to the US, UK citizens are subject to some informal safeguards between GCHQ and the National Security Agency (NSA); expresses deep concern that these safeguards would not protect EU citizens or residents whose data may be subject to onward transfers and sharing with the NSA;

Or. en

Amendment 89 Sophia in 't Veld

Draft motion for a resolution Paragraph 11

Draft motion for a resolution Amendment

11. Is concerned that the draft 11. Considers it unacceptable that the adequacy decisions fail to take into account draft adequacy decisions fail to take into either the actual use of UK bulk data account either the lack of limitations on powers or UK-US surveillance operations; the use of UK bulk data powers, or the points out that furthermore, in relation to actual use of UK-US surveillance the US, UK citizens are subject to some operations, including the data sharing informal safeguards between GCHQ and arrangement between the 5 EYES and the National Security Agency (NSA); cooperation between the GCHQ and NSA; expresses deep concern that these points out that furthermore, in relation to safeguards would not protect EU citizens the US, UK citizens are subject to some or residents whose data may be subject to informal safeguards between GCHQ and onward transfers and sharing with the the National Security Agency (NSA); NSA; expresses deep concern that these safeguards would not protect EU citizens or residents whose data may be subject to onward transfers and sharing with the NSA;

Or. en

Amendment 90

PE691.441v01-00 50/88 AM\1229955EN.docx EN Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 11

Draft motion for a resolution Amendment

11. Is concerned that the draft 11. Is concerned about the actual use of adequacy decisions fail to take into UK bulk data powers and UK-US account either the actual use of UK bulk surveillance operations; points out that data powers or UK-US surveillance further sharing of personal data with operations; points out that furthermore, in intelligence agencies in third countries are relation to the US, UK citizens are subject subject to specific safeguards provided in to some informal safeguards between the Data Protection Act 2019 and the GCHQ and the National Security Agency Investigatory Powers Act 2016; is (NSA); expresses deep concern that these concerned that these safeguards do not safeguards would not protect EU citizens sufficiently protect EU citizens or residents or residents whose data may be subject to whose data may be subject to onward onward transfers and sharing with the transfers and sharing with the NSA; NSA;

Or. en

Amendment 91 Moritz Körner, Michal Šimečka, Jan-Christoph Oetjen, Sophia in 't Veld

Draft motion for a resolution Paragraph 11 a (new)

Draft motion for a resolution Amendment

11 a. Calls on the Member States to enter into no-spying agreements with the UK and calls on the Commission to use its exchanges with its UK counterparts to convey the message that, if there is no modification of the UK surveillance laws and practices, the only feasible option to facilitate the adequacy decisions would be the conclusion of "no-spying" agreements with the Member States;

Or. en

Amendment 92 Gwendoline Delbos-Corfield

AM\1229955EN.docx 51/88 PE691.441v01-00 EN Draft motion for a resolution Paragraph 12

Draft motion for a resolution Amendment

12. Takes note of the fact that the 12. Takes note of the fact that the European Union (Withdrawal) Act 2018 European Union (Withdrawal) Act 2018 provides that CJEU case law generated provides that CJEU case law generated before the end of the transition period will before the end of the transition period will become ‘retained EU law’ and thus legally become ‘retained EU law’ and thus legally binding for the UK; points out that the UK binding for the UK; points out that the UK is bound by the principles and conditions is bound by the principles and conditions defined in the Schrems II judgment of the defined in the Schrems II judgment of the CJEU when assessing the adequacy of CJEU when assessing the adequacy of other non-EU countries; considers this an other non-EU countries; is however important safeguard to ensure the legality concerned that UK courts will not apply of onward transfers; the EU Charter of Fundamental Rights anymore, points out that the UK is not under the jurisdiction of the CJEU anymore, which is the highest instance to interpret the Charter;

Or. en

Amendment 93 Cornelia Ernst

Draft motion for a resolution Paragraph 12

Draft motion for a resolution Amendment

12. Takes note of the fact that the 12. Strongly underlines the fact that European Union (Withdrawal) Act 2018 the European Union (Withdrawal) Act provides that CJEU case law generated 2018 provides that CJEU case law before the end of the transition period will generated before the end of the transition become ‘retained EU law’ and thus legally period will become ‘retained EU law’ and binding for the UK; points out that the UK thus legally binding for the UK; points out is bound by the principles and conditions that the UK is bound by the principles and defined in the Schrems II judgment of the conditions defined in the Schrems I and CJEU when assessing the adequacy of Schrems II judgment of the CJEU when other non-EU countries; considers this an assessing the adequacy of other non-EU important safeguard to ensure the legality countries; considers this an important of onward transfers; safeguard to ensure the legality of onward transfers;

Or. en

PE691.441v01-00 52/88 AM\1229955EN.docx EN Amendment 94 Assita Kanko

Draft motion for a resolution Paragraph 12

Draft motion for a resolution Amendment

12. Takes note of the fact that the 12. Welcomes the fact that the European Union (Withdrawal) Act 2018 European Union (Withdrawal) Act 2018 provides that CJEU case law generated provides that CJEU case law generated before the end of the transition period will before the end of the transition period will become ‘retained EU law’ and thus legally become ‘retained EU law’ and thus legally binding for the UK; points out that the UK binding for the UK; points out that the UK is bound by the principles and conditions is bound by the principles and conditions defined in the Schrems II judgment of the defined in the Schrems II judgment of the CJEU when assessing the adequacy of CJEU when assessing the adequacy of other non-EU countries; considers this an other non-EU countries; considers this an important safeguard to ensure the legality important safeguard to ensure the legality of onward transfers; of onward transfers;

Or. en

Amendment 95 Assita Kanko

Draft motion for a resolution Paragraph 13

Draft motion for a resolution Amendment

13. Points out that the UK rules on the deleted sharing of personal data under the Digital Economy Act 2017 and on onward transfers of research data are clearly not ‘essentially equivalent’ to the rules set out in the GDPR, as interpreted by the CJEU;

Or. en

Amendment 96 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution

AM\1229955EN.docx 53/88 PE691.441v01-00 EN Paragraph 13

Draft motion for a resolution Amendment

13. Points out that the UK rules on the deleted sharing of personal data under the Digital Economy Act 2017 and on onward transfers of research data are clearly not ‘essentially equivalent’ to the rules set out in the GDPR, as interpreted by the CJEU;

Or. en

Amendment 97 Assita Kanko

Draft motion for a resolution Paragraph 14

Draft motion for a resolution Amendment

14. Is strongly concerned that a UK deleted adequacy status would therefore lead to the bypassing of the EU rules on transfers to countries or territories not deemed adequate under EU law;

Or. en

Amendment 98 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 14

Draft motion for a resolution Amendment

14. Is strongly concerned that a UK 14. Is concerned that the UK has adequacy status would therefore lead to the granted itself the right to declare that bypassing of the EU rules on transfers to other third countries or territories provide countries or territories not deemed adequate data protection, irrespective of adequate under EU law; whether the third country or territory in question has been held to provide such protection by the EU; reminds that the UK has already declared that Gibraltar provides such protection even though the

PE691.441v01-00 54/88 AM\1229955EN.docx EN EU has not done so; is strongly concerned that a UK adequacy status would therefore lead to the bypassing of the EU rules on transfers to countries or territories not deemed adequate under EU law;

Or. en

Amendment 99 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 14

Draft motion for a resolution Amendment

14. Is strongly concerned that a UK 14. Underlines that the UK rules adequacy status would therefore lead to governing personal data transfers to third the bypassing of the EU rules on transfers countries are identical to the rules to countries or territories not deemed provided in the GDPR; considers, adequate under EU law; however, that the Commission should monitor the application of these rules in practice as the UK’s granting of adequacy status to countries or territories not deemed adequate under EU law could lead to the bypassing of the EU rules on transfers;

Or. en

Amendment 100 Assita Kanko

Draft motion for a resolution Paragraph 15

Draft motion for a resolution Amendment

15. Takes note that on 1 February 2021, 15. Takes note that on 1 February 2021, the UK sent a request to join the the UK sent a request to join the Comprehensive and Progressive Trans- Comprehensive and Progressive Trans- Pacific Partnership (CPTTP), in particular Pacific Partnership (CPTTP), in particular to ‘benefit from modern digital trade rules to ‘benefit from modern digital trade rules that allow data to flow freely between that allow data to flow freely between members, remove unnecessary barriers for members, remove unnecessary barriers for businesses [etc.]’; notes with concern that businesses [etc.]’; notes with concern that there are eleven members of the CPTTP, there are eleven members of the CPTTP,

AM\1229955EN.docx 55/88 PE691.441v01-00 EN eight of which do not have an adequacy eight of which do not have an adequacy decision from the EU; is strongly decision from the EU; is strongly concerned about potential onward transfers concerned about potential onward transfers of personal data from EU citizens and of personal data from EU citizens and residents to these countries if the UK is residents to these countries if the UK is granted an adequacy decision20 ; granted an adequacy decision[1]; stresses that any personal data of EU citizens can only be transferred from the UK to another third country, if the data protection standards that govern that onward transfer of data, is deemed to provide an adequate and equivalent level of protection as the EU; ______20 Source: https://www.gov.uk/government/news/uk- applies-to-join-huge-pacific-free-trade- area-cptpp

Or. en

Amendment 101 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 15

Draft motion for a resolution Amendment

15. Takes note that on 1 February 2021, 15. Takes note that on 1 February 2021, the UK sent a request to join the the UK sent a request to join the Comprehensive and Progressive Trans- Comprehensive and Progressive Trans- Pacific Partnership (CPTTP), in particular Pacific Partnership (CPTPP), in particular to ‘benefit from modern digital trade rules to ‘benefit from modern digital trade rules that allow data to flow freely between that allow data to flow freely between members, remove unnecessary barriers for members, remove unnecessary barriers for businesses [etc.]’; notes with concern that businesses [...]’; notes eight of the eleven there are eleven members of the CPTTP, members of the CPTTP are not subject to eight of which do not have an adequacy an adequacy decision from the EU; decision from the EU; is strongly reminds that if the UK is granted an concerned about potential onward adequacy decision[1], onward transfers of transfers of personal data from EU citizens personal data from EU citizens and and residents to these countries if the UK is residents to these countries would only be granted an adequacy decision20 ; possible in compliance with the UK’s national rules on transfers to third countries, which are exactly the same as those provided in Chapter V of the GDPR;

PE691.441v01-00 56/88 AM\1229955EN.docx EN [1] Source: https://www.gov.uk/government/news/uk- applies-to-join-huge-pacific-free-trade- area-cptpp ______20 Source: https://www.gov.uk/government/news/uk- applies-to-join-huge-pacific-free-trade- area-cptpp

Or. en

Amendment 102 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 15 a (new)

Draft motion for a resolution Amendment

15 a. Takes note of a recent op-ed by the UK Minister of State for Media and Data, John Whittingdale, in which he claims that the UK “will champion the international flow of data”1a; notes that the UK Integrated Review of 16 March 20211b points at the UK working with “international partners to overcome barriers to data flows and promote international data standards that enable growth and innovation” and that the UK will “tilt to the Indo-Pacific” region; ______1a https://www.privacylaws.com/reports- gateway/articles/uk114/uk114datatransfer s/ 1b Global Britain in a Competitive Age: the Integrated Review of Security, Defence, Development and Foreign Policy, https://www.gov.uk/government/publicatio ns/global-britain-in-a-competitive-age- the-integrated-review-of-security-defence- development-and-foreign-policy/global- britain-in-a-competitive-age-the- integrated-review-of-security-defence-

AM\1229955EN.docx 57/88 PE691.441v01-00 EN development-and-foreign-policy

Or. en

Amendment 103 Sophia in 't Veld

Draft motion for a resolution Paragraph 15 a (new)

Draft motion for a resolution Amendment

15 a. Regrets that the Commission did not assess the impact and potential risks of the Agreement between the UK and Japan for a Comprehensive Economic Partnership (CEPA), which includes provisions on personal data, on the level of data protection;

Or. en

Amendment 104 Assita Kanko

Draft motion for a resolution Paragraph 16

Draft motion for a resolution Amendment

16. Is concerned that if the UK deleted includes provisions on data transfers in any future trade agreements, inter alia US-UK trade agreements, the level of protection offered by the GDPR would be undermined;

Or. en

Amendment 105 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 16

PE691.441v01-00 58/88 AM\1229955EN.docx EN Draft motion for a resolution Amendment

16. Is concerned that if the UK includes 16. Is concerned that if the UK includes provisions on data transfers in any future provisions on data transfers in any future trade agreements, inter alia US-UK trade trade agreements, inter alia US-UK trade agreements, the level of protection offered agreements, the level of protection offered by the GDPR would be undermined; by the GDPR would be undermined; takes note that on 1st February 2021, the UK has sent a request1a to join the Comprehensive and Progressive Trans- Pacific Partnership (CPPTP), in particular to “benefit “from “modern digital trade rules that allow data to flow freely between members, remove unnecessary barriers for businesses,”, notes with concern that the CPTTP membership includes eight countries that do not have an adequacy decision from the European Union, namely Australia, Brunei, Chile, Malaysia, Mexico, Peru, Singapore, and Vietnam; is strongly concerned about the potential onward transfer of personal data from EU citizens to these countries if the UK would be granted an adequacy decision; notes with concern that the EU-UK Trade and Cooperation Agreement deviated from the EU's 2018 horizontal position on cross- border data flows and the protection of personal data, which could create risks for the protection of citizens' rights to privacy and personal data protection; ______1a https://www.gov.uk/government/news/uk- applies-to-join-huge-pacific-free-trade- area-cptpp

Or. en

Amendment 106 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 16

AM\1229955EN.docx 59/88 PE691.441v01-00 EN Draft motion for a resolution Amendment

16. Is concerned that if the UK 16. Notes that if the UK includes includes provisions on data transfers in any provisions on data transfers in any future future trade agreements, inter alia US-UK trade agreements, inter alia US-UK trade trade agreements, the level of protection agreements, this could entail the risk of offered by the GDPR would be the level of protection for personal data undermined; provided by the UK being lowered; calls therefore on the Commission to monitor this aspect;

Or. en

Amendment 107 Cornelia Ernst

Draft motion for a resolution Paragraph 16

Draft motion for a resolution Amendment

16. Is concerned that if the UK includes 16. Is concerned that if the UK includes provisions on data transfers in any future provisions on data transfers in any future trade agreements, inter alia US-UK trade trade agreements, inter alia US-UK trade agreements, the level of protection offered agreements, the level of protection offered by the GDPR would be undermined; by the GDPR would be undermined and bypassed

Or. en

Amendment 108 Cornelia Ernst

Draft motion for a resolution Paragraph 17

Draft motion for a resolution Amendment

17. Highlights that the UK is the first 17. Highlights that the UK is the first country for which the Commission has country for which the Commission has suggested adopting an adequacy decision suggested adopting an adequacy decision under Directive (EU) 2016/680; underlines under Directive (EU) 2016/680; that this is particularly important given the close partnership with the UK in the area of security and law enforcement;

PE691.441v01-00 60/88 AM\1229955EN.docx EN Or. en

Amendment 109 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 17

Draft motion for a resolution Amendment

17. Highlights that the UK is the first 17. Highlights that the UK is the first country for which the Commission has country for which the Commission has suggested adopting an adequacy decision suggested adopting an adequacy decision under Directive (EU) 2016/680; underlines under Directive (EU) 2016/680; that this is particularly important given the close partnership with the UK in the area of security and law enforcement;

Or. en

Amendment 110 Assita Kanko

Draft motion for a resolution Paragraph 17

Draft motion for a resolution Amendment

17. Highlights that the UK is the first 17. Highlights that the UK is the first country for which the Commission has country for which the Commission has suggested adopting an adequacy decision suggested adopting an adequacy decision under Directive (EU) 2016/680; underlines under Directive (EU) 2016/680; underlines that this is particularly important given the that this is particularly important given the close partnership with the UK in the area close partnership with the UK in the area of security and law enforcement; of security and law enforcement and the essential contribution of the UK to EU security and law enforcement;

Or. en

Amendment 111 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution

AM\1229955EN.docx 61/88 PE691.441v01-00 EN Paragraph 18

Draft motion for a resolution Amendment

18. Notes the UK’s cross-border data 18. Notes the UK’s cross-border data access agreement with the US21 , under the access agreement negotiated with the US21 US CLOUD Act, which facilitates , under the US CLOUD Act, which should transfers for law enforcement purposes; is facilitate transfers for law enforcement concerned that this will allow undue purposes; takes note that the agreement access to the personal data of EU citizens has not yet entered into force as the UK is and residents by US authorities; seeking additional safeguards from the US and has committed to informing the Commission of those additional safeguards before the agreement enters into force; expects those safeguards to prevent undue access to the personal data of EU citizens and residents by US authorities and calls on the Commission to monitor the implementation of the agreement in this regard; ______21 Agreement between the Government of 21 Agreement between the Government of the United Kingdom of Great Britain and the United Kingdom of Great Britain and Northern Ireland and the Government of Northern Ireland and the Government of the United States of America of 3 October the United States of America of 3 October 2019 on Access to Electronic Data for the 2019 on Access to Electronic Data for the Purpose of Countering Serious Crime. Purpose of Countering Serious Crime.

Or. en

Amendment 112 Sophia in 't Veld

Draft motion for a resolution Paragraph 18

Draft motion for a resolution Amendment

18. Notes the UK’s cross-border data 18. Notes the UK’s cross-border data access agreement with the US21 , under the access agreement with the US21 , under the US CLOUD Act, which facilitates transfers US CLOUD Act, which facilitates transfers for law enforcement purposes; is concerned for law enforcement purposes; is concerned that this will allow undue access to the that this will allow undue access to the personal data of EU citizens and residents personal data of EU citizens and residents by US authorities; by US authorities; shares the concern of the EDPB as to whether the safeguards provided under the EU-US Umbrella

PE691.441v01-00 62/88 AM\1229955EN.docx EN Agreement applied on a mutatis mutandis basis would meet the criteria of clear, precise and accessible rules when it comes to access to personal data, or would sufficiently enshrine such safeguards to be effective and actionable under UK law. ______21 Agreement between the Government of 21 Agreement between the Government of the United Kingdom of Great Britain and the United Kingdom of Great Britain and Northern Ireland and the Government of Northern Ireland and the Government of the United States of America of 3 October the United States of America of 3 October 2019 on Access to Electronic Data for the 2019 on Access to Electronic Data for the Purpose of Countering Serious Crime. Purpose of Countering Serious Crime.

Or. en

Amendment 113 Katarina Barley, Marina Kaljurand

Draft motion for a resolution Paragraph 18

Draft motion for a resolution Amendment

18. Notes the UK’s cross-border data 18. Notes the UK’s cross-border data access agreement with the US21 , under the access agreement with the US21 , under the US CLOUD Act, which facilitates transfers US CLOUD Act, which facilitates transfers for law enforcement purposes; is concerned for law enforcement purposes; is concerned that this will allow undue access to the that this will allow undue access to the personal data of EU citizens and residents personal data of EU citizens and residents by US authorities; by US authorities; notes that the EDPB has strong concerns in relation to the agreement which, once it enters into force, could substantially affect the level of protection of data transferred to the UK; ______21 Agreement between the Government of 21 Agreement between the Government of the United Kingdom of Great Britain and the United Kingdom of Great Britain and Northern Ireland and the Government of Northern Ireland and the Government of the United States of America of 3 October the United States of America of 3 October 2019 on Access to Electronic Data for the 2019 on Access to Electronic Data for the Purpose of Countering Serious Crime. Purpose of Countering Serious Crime.

Or. en

AM\1229955EN.docx 63/88 PE691.441v01-00 EN Amendment 114 Assita Kanko

Draft motion for a resolution Paragraph 18

Draft motion for a resolution Amendment

18. Notes the UK’s cross-border data 18. Notes the UK’s cross-border data access agreement with the US21 , under the access agreement with the US21 , under the US CLOUD Act, which facilitates transfers UK’s Crime (Overseas Production for law enforcement purposes; is concerned Orders) Act 2019 ( “OPO Act”) and the that this will allow undue access to the US’ Clarifying Lawful Overseas Use of personal data of EU citizens and residents Data Act (“CLOUD Act”), which by US authorities; facilitates transfers for law enforcement purposes; is concerned that this will allow undue access to the personal data of EU citizens and residents by US authorities; ______21 Agreement between the Government of 21 Agreement between the Government of the United Kingdom of Great Britain and the United Kingdom of Great Britain and Northern Ireland and the Government of Northern Ireland and the Government of the United States of America of 3 October the United States of America of 3 October 2019 on Access to Electronic Data for the 2019 on Access to Electronic Data for the Purpose of Countering Serious Crime. Purpose of Countering Serious Crime.

Or. en

Amendment 115 Cornelia Ernst

Draft motion for a resolution Paragraph 18

Draft motion for a resolution Amendment

18. Notes the UK’s cross-border data 18. Notes the UK’s cross-border data access agreement with the US21 , under the access agreement with the US21 , under the US CLOUD Act, which facilitates transfers US CLOUD Act, which facilitates transfers for law enforcement purposes; is concerned for law enforcement purposes; is deeply that this will allow undue access to the concerned that this will allow undue access personal data of EU citizens and residents to the personal data of EU citizens and by US authorities; residents by US authorities; ______21 Agreement between the Government of 21 Agreement between the Government of

PE691.441v01-00 64/88 AM\1229955EN.docx EN the United Kingdom of Great Britain and the United Kingdom of Great Britain and Northern Ireland and the Government of Northern Ireland and the Government of the United States of America of 3 October the United States of America of 3 October 2019 on Access to Electronic Data for the 2019 on Access to Electronic Data for the Purpose of Countering Serious Crime. Purpose of Countering Serious Crime.

Or. en

Amendment 116 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 19

Draft motion for a resolution Amendment

19. Recalls that CJEU judgment C- 19. Recalls that CJEU in its judgment 623/17 must be interpreted as precluding C-623/17 clearly stated that the ePrivacy national legislation enabling a state Directive read in light of the relevant authority to require providers of electronic provisions of the Charter does not communications services to carry out the preclude national legislation enabling a general and indiscriminate transmission of state authority to require providers of traffic data and location data to the state’s electronic communications services to security and intelligence agencies for the carry out the general and indiscriminate purpose of safeguarding national security; transmission of traffic data and location data to the state’s security and intelligence agencies in case of a serious threat to national security and subject to strict conditions;

Or. en

Amendment 117 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 20

Draft motion for a resolution Amendment

20. Notes that in this case, the CJEU 20. Notes that in this case, the CJEU ruled that the bulk data collection carried ruled that the bulk data collection carried out in the UK under the Regulation of out in the UK under the Regulation of Investigatory Powers Act 2000 was illegal; Investigatory Powers Act 2000 was illegal; points out that the regulation has since points out that by that time, the regulation been replaced by the Investigatory Powers had long been replaced by the

AM\1229955EN.docx 65/88 PE691.441v01-00 EN Act (the IPA 2016) in order to strengthen Investigatory Powers Act (the IPA 2016) the principles of necessity and which considerably strengthened the proportionality; underlines that the IPA principles of necessity and proportionality; 2016 makes interception subject to judicial underlines that the IPA 2016 makes oversight and empowers individuals to interception subject to prior judicial access their data and lodge complaints approval and oversight and empowers before the investigatory powers tribunal; individuals to access their data and lodge deplores, however, the fact that the IPA complaints before the investigatory powers 2016 continues to enable the practice of tribunal; stresses that these safeguards bulk data retention; were welcomed by the UN Rapporteur on the Right to Privacy and deemed a “significant improvement” of the UK regime by the EDPB; deplores, the fact that the IPA 2016 continues to enable the practice of bulk data retention while recognising that the above mentioned limitations, safeguards and avenues for redress apply also in case of data retention and data collection in bulk;

Or. en

Amendment 118 Assita Kanko

Draft motion for a resolution Paragraph 20

Draft motion for a resolution Amendment

20. Notes that in this case, the CJEU 20. Notes that in this case, the CJEU ruled that the bulk data collection carried ruled that the bulk data collection carried out in the UK under the Regulation of out in the UK under the Regulation of Investigatory Powers Act 2000 was illegal; Investigatory Powers Act 2000 was illegal; points out that the regulation has since points out that the regulation has since been replaced by the Investigatory Powers been replaced by the Investigatory Powers Act (the IPA 2016) in order to strengthen Act (the IPA 2016) in order to strengthen the principles of necessity and the principles of necessity and proportionality; underlines that the IPA proportionality; underlines that the IPA 2016 makes interception subject to judicial 2016 makes interception subject to judicial oversight and empowers individuals to oversight and empowers individuals to access their data and lodge complaints access their data and lodge complaints before the investigatory powers tribunal; before the investigatory powers tribunal; deplores, however, the fact that the IPA 2016 continues to enable the practice of bulk data retention;

Or. en

PE691.441v01-00 66/88 AM\1229955EN.docx EN Amendment 119 Assita Kanko

Draft motion for a resolution Paragraph 21

Draft motion for a resolution Amendment

21. Is concerned about recent reports deleted that a mass data collection and retention scheme is part of a trial by the UK Home Office conducted under the IPA 2016;

Or. en

Amendment 120 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 21

Draft motion for a resolution Amendment

21. Is concerned about recent reports 21. Is concerned about recent reports that a mass data collection and retention that two UK internet access providers are scheme is part of a trial by the UK Home tracking and collecting the websites Office conducted under the IPA 2016; visited by their customers, as part of a secretive Home Office mass data collection and retention trial under the IPA 2016, which is set to work out if a national bulk surveillance system would be “useful for national security and law enforcement”1a is equally concerned about a draft UK bill requiring internet service providers and more generally communications service providers to "prevent activities that unreasonably restrict monitoring, analysis and investigation"1b ; ______1a https://www.theguardian.com/world/2021/ mar/11/internet-providers-tracking-sites- we-visit-in-secretive-trial, see also https://www.wired.co.uk/article/internet- connection-records-ip-act

AM\1229955EN.docx 67/88 PE691.441v01-00 EN 1b https://www.theregister.com/2021/03/12/is p_industry_on_telecoms_security_bill/

Or. en

Amendment 121 Sophia in 't Veld

Draft motion for a resolution Paragraph 22

Draft motion for a resolution Amendment

22. Is concerned about the 22. Is concerned about the shortcomings and violations identified in shortcomings and violations identified in the way the UK implemented data the way the UK implemented data protection law while it was still a member protection law while it was still a member of the EU; recalls that the UK was of the EU; recalls that the UK was recording and maintaining an illegal copy recording and maintaining an illegal copy of the Schengen Information System; is of the Schengen Information System; therefore concerned about data being points out that, despite the fact that the exchanged with UK law enforcement UK does not have access anymore to SIS, agencies, and about the UK maintaining these violations have demonstrated that access to EU law enforcement databases; the UK authorities could not be trusted with EU citizens’ data while it was still a Member State; regrets therefore that the Commission has failed to execute its task as Guardian of the Treaties, by not sufficiently pressuring the UK to urgently solve these problems in an adequate and timely manner and to demonstrate that it can be entrusted with the processing of personal data for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties; is therefore concerned about data being exchanged with UK law enforcement agencies, and about the UK maintaining access to EU law enforcement databases; stresses that an adequacy decision should not be granted as long as these violations have not been resolved;

Or. en

PE691.441v01-00 68/88 AM\1229955EN.docx EN Amendment 122 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 22

Draft motion for a resolution Amendment

22. Is concerned about the 22. Reminds that in its Resolution of shortcomings and violations identified in 12 February 20201a, the European the way the UK implemented data Parliament stressed that “the UK cannot protection law while it was still a member have a direct access to EU information of the EU; recalls that the UK was systems data or participate in the recording and maintaining an illegal copy management structures of the EU of the Schengen Information System; is agencies in the area of Freedom, Security therefore concerned about data being and Justice, while any sharing of exchanged with UK law enforcement information including personal data agencies, and about the UK maintaining with the UK should be subject to strict access to EU law enforcement databases; safeguards, audit and oversight conditions, including an equivalent level of protection of personal data to that provided by Union law”; Is concerned about the shortcomings and violations identified in the way the UK implemented data protection law while it was still a member of the EU; recalls that the UK was recording and maintaining an illegal copy of the Schengen Information System; is therefore concerned about data being exchanged with UK law enforcement agencies, and about the UK maintaining access to EU law enforcement databases; ______1a P9_TA-PROV(2020)0033, https://www.europarl.europa.eu/doceo/doc ument/TA-9-2020-0033_EN.html

Or. en

Amendment 123 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 22

Draft motion for a resolution Amendment

AM\1229955EN.docx 69/88 PE691.441v01-00 EN 22. Is concerned about the 22. Is concerned about the shortcomings and violations identified in shortcomings and violations identified in the way the UK implemented data the way the UK implemented data protection law while it was still a member protection law while it was still a member of the EU; recalls that the UK was of the EU; recalls that the UK was recording and maintaining an illegal copy recording and maintaining an illegal copy of the Schengen Information System; is of the Schengen Information System; therefore concerned about data being expects UK law enforcement agencies to exchanged with UK law enforcement fully comply with the applicable rules agencies, and about the UK maintaining when exchanging personal data in the access to EU law enforcement databases; future; reminds that the UK maintains access to some EU law enforcement databases only on a hit/no hit basis and is legally excluded from accessing the Schengen Information System;

Or. en

Amendment 124 Sophia in 't Veld

Draft motion for a resolution Paragraph 22 a (new)

Draft motion for a resolution Amendment

22 a. Expresses its concern over the January 2021 revelation that 400,000 criminal records were accidentally deleted from the UK Police National Computer; stresses that this does not contribute to trust in the UK's efforts in data protection for law enforcement purposes;

Or. en

Amendment 125 Assita Kanko

Draft motion for a resolution Paragraph 23

Draft motion for a resolution Amendment

23. Notes that the draft adequacy deleted decision fails to take account of the UK’s

PE691.441v01-00 70/88 AM\1229955EN.docx EN actual surveillance practices and reflects an inaccurate and limited understanding of the types of communications data that fall under UK data retention and lawful interception powers;

Or. en

Amendment 126 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 23

Draft motion for a resolution Amendment

23. Notes that the draft adequacy 23. Notes that the draft adequacy decision fails to take account of the UK’s decision fails to take account of the UK’s actual surveillance practices and reflects an actual surveillance practices and reflects an inaccurate and limited understanding of the inaccurate and limited understanding of the types of communications data that fall types of communications data that fall under UK data retention and lawful under UK data retention and lawful interception powers; interception powers; points out that the draft decision reads as if the UK definition of 'telecommunication system' mirrors that used in European law; reminds that in UK law, a “telecommunication system” means a system that exists (whether wholly or partly in the United Kingdom or elsewhere) for the purpose of facilitating the transmission of communications by any means involving the use of electrical or electromagnetic energy (Investigatory Powers Act 2016 s 261(13)); underlines that this is significantly wider than the EU definitions of 'publicly available electronic communications services’, and can include over-the-top services, cloud platforms, and the like; is worried that even if data is running on EU-based systems whose code is controlled by entities which can be required by the UK intelligence agencies to alter such code to exfiltrate such data, it can be accessed; is equally worried that if data enters the UK, even for the purposes of caching during transit, and the entity falls within the wide

AM\1229955EN.docx 71/88 PE691.441v01-00 EN definition of telecommunications operator, the latter can be required to retain such data and provide it to the UK intelligence services;

Or. en

Amendment 127 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 23

Draft motion for a resolution Amendment

23. Notes that the draft adequacy 23. Notes that the draft adequacy decision fails to take account of the UK’s decision thoroughly assesses the rights of actual surveillance practices and reflects each UK authority empowered by national an inaccurate and limited understanding law to intercept and retain personal data of the types of communications data that for national security reasons; welcomes fall under UK data retention and lawful furthermore that detailed oversight interception powers; reports concerning Intelligence Community authorities provide information regarding the UK’s actual surveillance practices; calls on the Commission to further assess and monitor the types of communications data that fall under UK data retention and lawful interception powers;

Or. en

Amendment 128 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 24

Draft motion for a resolution Amendment

24. Points out that the EU-UK Trade 24. Points out that the EU-UK Trade and Cooperation Agreement (TCA) and Cooperation Agreement (TCA) includes titles regarding the exchange of includes titles regarding the exchange of DNA, fingerprints and vehicle registration DNA, fingerprints and vehicle registration data, the transfer and processing of data, the transfer and processing of passenger name record data (PNR), passenger name record data (PNR),

PE691.441v01-00 72/88 AM\1229955EN.docx EN cooperation on operational information and cooperation on operational information and cooperation with Europol and Eurojust, cooperation with Europol and Eurojust but which will apply regardless of the does in itself not provide a legal basis for adequacy decision; recalls, however, the transfers; stresses that these provisions concerns expressed in the opinion of the can be suspended in case the UK shows Committee on Civil Liberties, Justice and serious deficiencies regarding the Home Affairs of February 2021 on the protection of personal data, including TCA regarding the special use and longer where which will apply regardless of the retention of personal data granted to the adequacy decision; recalls, the concerns UK under the Prüm and PNR titles of the expressed in the opinion of the Committee TCA, which are not in line with the uses on Civil Liberties, Justice and Home and retentions by the Member States; Affairs of February 2021 on the TCA regarding the special use and, during an interim period and subject to additional safeguards, longer retention of personal data granted to the UK under the PNR title of the TCA; acknowledges that PNR agreements with other third countries also provide for the processing of PNR data to protect the vital interests of any individual and that the CJEU has accepted such exceptional uses in its opinion on the draft EU-Canada agreement; welcomes that the processing of special categories of data remains prohibited;

Or. en

Amendment 129 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 24

Draft motion for a resolution Amendment

24. Points out that the EU-UK Trade 24. Points out that the EU-UK Trade and Cooperation Agreement (TCA) and Cooperation Agreement (TCA) includes titles regarding the exchange of includes titles regarding the exchange of DNA, fingerprints and vehicle registration DNA, fingerprints and vehicle registration data, the transfer and processing of data, the transfer and processing of passenger name record data (PNR), passenger name record data (PNR), cooperation on operational information and cooperation on operational information and cooperation with Europol and Eurojust, cooperation with Europol and Eurojust, which will apply regardless of the which will apply regardless of the adequacy decision; recalls, however, the adequacy decision; recalls, however, the concerns expressed in the opinion of the concerns expressed in the opinion of the Committee on Civil Liberties, Justice and Committee on Civil Liberties, Justice and

AM\1229955EN.docx 73/88 PE691.441v01-00 EN Home Affairs of February 2021 on the Home Affairs of February 2021 on the TCA regarding the special use and longer TCA regarding the special use and longer retention of personal data granted to the retention of personal data granted to the UK under the Prüm and PNR titles of the UK under the Prüm and PNR titles of the TCA, which are not in line with the uses TCA, which are not in line with the uses and retentions by the Member States; and retentions by the Member States; Reminds of the right to bring an action before the Court of Justice in order to seek verification of the legality of the projected international agreement and, in particular, the compatibility thereof with the protection of a fundamental right1a ______1a European Parliament resolution on the draft Commission decision noting the adequate level of protection provided for personal data contained in the Passenger Name Records (PNRs) transferred to the US Bureau of Customs and Border Protection (2004/2011(INI))

Or. en

Amendment 130 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 24 a (new)

Draft motion for a resolution Amendment

24 a. Notes that the TCA provisions concerning Prüm data are mostly in line with internal EU rules but have been adapted regarding evaluations, suspension and disapplication;

Or. en

Amendment 131 Sophia in 't Veld

Draft motion for a resolution Paragraph 24 a (new)

PE691.441v01-00 74/88 AM\1229955EN.docx EN Draft motion for a resolution Amendment

24 a. Points out that the GDPR requires the Commission in adequacy assessments to take account of legislation concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as international commitments in relation to the protection of personal data; regrets that the Commission has not sufficiently done so;

Or. en

Amendment 132 Moritz Körner, Michal Šimečka, Jan-Christoph Oetjen, Sophia in 't Veld, Olivier Chastel

Draft motion for a resolution Paragraph 24 a (new)

Draft motion for a resolution Amendment

24 a. Believes that for the reasons above, the Commission can not yet adopt legally sound adequacy decisions concerning the UK’s data protection regime; recommends to prolong the current transition period by another six months to allow the UK authorities to solve the issues mentioned above;

Or. en

Amendment 133 Sophia in 't Veld

Draft motion for a resolution Paragraph 24 b (new)

Draft motion for a resolution Amendment

24 b. Points out that the Court of Justice of the European Union clearly stated in its Schrems I ruling that when examining

AM\1229955EN.docx 75/88 PE691.441v01-00 EN the level of protection afforded by a third country, the Commission is obliged to assess the content of the applicable rules in that country resulting from its domestic law or international commitments and the practice designed to ensure compliance with those rules, since it must take account of all the circumstances surrounding a transfer of personal data to a third country;

Or. en

Amendment 134 Sophia in 't Veld

Draft motion for a resolution Paragraph 24 c (new)

Draft motion for a resolution Amendment

24 c. Points out that intelligence services activities and sharing with third countries are in the scope of the necessary adequacy assessment of the level of personal data offered by third countries, as confirmed by the CJEU in the Schrems I and II rulings;

Or. en

Amendment 135 Sophia in 't Veld

Draft motion for a resolution Paragraph 24 d (new)

Draft motion for a resolution Amendment

24 d. Takes the view that by adopting the two implementing decisions, which are not consistent with Union law, without having solved all the concerns expressed in the present resolution, the Commission goes beyond the implementing powers conferred upon by Regulation (EU)

PE691.441v01-00 76/88 AM\1229955EN.docx EN 2016/679 and Directive (EU) 2016/680. Therefore objects to the two implementing acts; calls on the Commission to withdraw the current draft Implementing decisions and submit to Parliament amended draft implementing decisions that are fully consistent with Union law and clearly showing that the UK has addressed all the issues identified in the present resolution and in the EDPB opinions;

Or. en

Amendment 136 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 25

Draft motion for a resolution Amendment

25. Calls on the Commission to assure deleted EU businesses that the adequacy decision will provide a solid, sufficient and future- oriented legal basis for data transfers; underlines the importance of making sure that this adequacy decision will be deemed acceptable if reviewed by the CJEU and stresses that all recommendations made in the EDPB opinion should therefore be taken on board;

Or. en

Amendment 137 Cornelia Ernst

Draft motion for a resolution Paragraph 25

Draft motion for a resolution Amendment

25. Calls on the Commission to assure 25. Calls on the Commission to take on EU businesses that the adequacy decision board all recommendations made in the will provide a solid, sufficient and future- EDPB opinion. oriented legal basis for data transfers;

AM\1229955EN.docx 77/88 PE691.441v01-00 EN underlines the importance of making sure that this adequacy decision will be deemed acceptable if reviewed by the CJEU and stresses that all recommendations made in the EDPB opinion should therefore be taken on board;

Or. en

Amendment 138 Moritz Körner, Michal Šimečka, Jan-Christoph Oetjen

Draft motion for a resolution Paragraph 25

Draft motion for a resolution Amendment

25. Calls on the Commission to assure 25. Calls on the Commission to assure EU businesses that the adequacy decision EU businesses that the adequacy decision will provide a solid, sufficient and future- will provide a solid, sufficient and future- oriented legal basis for data transfers; oriented legal basis for data transfers; underlines the importance of making sure underlines the importance of making sure that this adequacy decision will be deemed that this adequacy decision will be deemed acceptable if reviewed by the CJEU and acceptable if reviewed by the CJEU and stresses that all recommendations made in stresses that all recommendations made in the EDPB opinion should therefore be the EDPB opinion should therefore be taken on board; taken on board; expects the Commission President to take full responsibility and to resign if adequacy is granted without solving the issues mentioned above and, later on, the adequacy decisions are not deemed acceptable by the CJEU;

Or. en

Amendment 139 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 25

Draft motion for a resolution Amendment

25. Calls on the Commission to assure 25. Calls on the Commission to assure EU businesses that the adequacy decision EU businesses that the adequacy decision will provide a solid, sufficient and future- will provide a solid legal basis for data

PE691.441v01-00 78/88 AM\1229955EN.docx EN oriented legal basis for data transfers; transfers insofar as the data protection underlines the importance of making sure regimes of the UK and the EU remain that this adequacy decision will be deemed convergent in law and in practice; acceptable if reviewed by the CJEU and underlines the importance of making sure stresses that all recommendations made in that this adequacy decision will be deemed the EDPB opinion should therefore be acceptable if reviewed by the CJEU and taken on board; stresses that all recommendations made in the EDPB opinion should therefore be taken on board;

Or. en

Amendment 140 Assita Kanko

Draft motion for a resolution Paragraph 25

Draft motion for a resolution Amendment

25. Calls on the Commission to assure 25. Calls on the Commission to assure EU businesses that the adequacy decision EU businesses that the adequacy decision will provide a solid, sufficient and future- will provide a solid, sufficient and future- oriented legal basis for data transfers; oriented legal basis for data transfers; underlines the importance of making sure underlines the importance of making sure that this adequacy decision will be deemed that this adequacy decision will be deemed acceptable if reviewed by the CJEU and acceptable if reviewed by the CJEU and stresses that all recommendations made in stresses that all recommendations made in the EDPB opinion should therefore be the EDPB opinion should therefore be taken on board; taken into serious consideration;

Or. en

Amendment 141 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 25 a (new)

Draft motion for a resolution Amendment

25 a. Expects the Commission, where available information reveals that the UK no longer ensures an adequate level of protection and to the extent necessary, to make use of the possibility to amend,

AM\1229955EN.docx 79/88 PE691.441v01-00 EN suspend or repeal the adequacy decision at any point in time, including by means of the urgency procedure foreseen in the draft adequacy decision; expects the Commission to first attempt to amend the decision before suspending or repealing, in order to avoid unnecessary disruptions or high compliance costs;

Or. en

Amendment 142 Moritz Körner, Michal Šimečka, Jan-Christoph Oetjen, Sophia in 't Veld, Olivier Chastel

Draft motion for a resolution Paragraph 25 a (new)

Draft motion for a resolution Amendment

25 a. Requests that national data protection authorities suspend the transfer of personal data which may be subject to indiscriminate access by UK intelligence authorities if the Commission were to adopt its adequacy decisions in relation to the UK before the UK would solve the issues mentioned above;

Or. en

Amendment 143 Katarina Barley, Marina Kaljurand

Draft motion for a resolution Paragraph 25 a (new)

Draft motion for a resolution Amendment

25 a. Calls on the Commission and the UK competent authorities to set up an action plan in order to address as soon as possible the deficiencies identified by the EDPB opinions and other outstanding issues in UK data protection, which shall be a precondition for the final adequacy

PE691.441v01-00 80/88 AM\1229955EN.docx EN decision;

Or. en

Amendment 144 Marina Kaljurand, Katarina Barley

Draft motion for a resolution Paragraph 25 a (new)

Draft motion for a resolution Amendment

25 a. Calls on the Commission to seek removal of the immigration exemption, or to ensure that it is reformed so that the exemption and its use provide sufficient safeguards for data subjects and do not breach the standards expected of a third country.

Or. en

Amendment 145 Cornelia Ernst

Draft motion for a resolution Paragraph 25 a (new)

Draft motion for a resolution Amendment

25 a. Takes the view that any adequacy decision with the UK should be reviewed on a regular basis. Underlines however that a review only every 4 years would be insufficient.

Or. en

Amendment 146 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 25 a (new)

AM\1229955EN.docx 81/88 PE691.441v01-00 EN Draft motion for a resolution Amendment

25 a. Calls on the Commission not to adopt adequacy decisions that would grant the UK the status of providing an adequate level of the protection of personal data;

Or. en

Amendment 147 Juan Fernando López Aguilar, Gwendoline Delbos-Corfield, Moritz Körner, Cornelia Ernst, Marina Kaljurand

Draft motion for a resolution Paragraph 25 a (new)

Draft motion for a resolution Amendment

25 a. Objects to the two implementing acts because the draft implementing decisions are not consistent with Union law

Or. en

Amendment 148 Juan Fernando López Aguilar, Gwendoline Delbos-Corfield, Moritz Körner, Cornelia Ernst, Marina Kaljurand

Draft motion for a resolution Paragraph 25 b (new)

Draft motion for a resolution Amendment

25 b. Calls on the Commission to amend the two draft Commission implementing Decisions with a view to making them fully consistent with Union law and case law.

Or. en

Amendment 149

PE691.441v01-00 82/88 AM\1229955EN.docx EN Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 26

Draft motion for a resolution Amendment

26. Welcomes the fact that the 26. Welcomes the fact that the adequacy decision will be reviewed every adequacy decisions will only apply for four four years and will include a sunset years since the UK might choose to amend clause, and calls on the Commission to the legislation subject to the keep monitoring the level of data Commission’s adequacy assessment now protection in the UK in law and practice in that it is no longer an EU Member State; the meantime; calls on the Commission to keep monitoring the level of data protection in the UK in law and practice in the meantime and to do a thorough assessment before renewing the adequacy decision in 2025;

Or. en

Amendment 150 Sophia in 't Veld

Draft motion for a resolution Paragraph 26

Draft motion for a resolution Amendment

26. Welcomes the fact that the 26. Welcomes the fact that the adequacy decision will be reviewed every adequacy decision will be reviewed every four years and will include a sunset clause, four years and will include a sunset clause, and calls on the Commission to keep and calls on the Commission to keep monitoring the level of data protection in monitoring the level of data protection in the UK in law and practice in the the UK in law and practice in the meantime meantime; and to amend, suspend and/or repeal the adequacy decision if material and practical changes would arise in the UK that would lower the protection of personal data;

Or. en

Amendment 151 Katarina Barley, Marina Kaljurand

AM\1229955EN.docx 83/88 PE691.441v01-00 EN Draft motion for a resolution Paragraph 26

Draft motion for a resolution Amendment

26. Welcomes the fact that the 26. Welcomes the fact that the adequacy decision will be reviewed every adequacy decision will be reviewed every four years and will include a sunset clause, four years and will include a sunset clause, and calls on the Commission to keep and calls on the Commission to keep monitoring the level of data protection in monitoring the level of data protection in the UK in law and practice in the the UK in law and practice in the meantime; meantime, and, if necessary, to take actions including by amending and/or suspending the decision;

Or. en

Amendment 152 Cornelia Ernst

Draft motion for a resolution Paragraph 26

Draft motion for a resolution Amendment

26. Welcomes the fact that the 26. Calls on the Commission to keep adequacy decision will be reviewed every closely monitoring the level of data four years and will include a sunset protection as well as laws and practices on clause, and calls on the Commission to mass surveillance in the UK in law and keep monitoring the level of data practice protection in the UK in law and practice in the meantime;

Or. en

Amendment 153 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 26

Draft motion for a resolution Amendment

26. Welcomes the fact that the 26. Points out that there are other adequacy decision will be reviewed every legal possibilities for transfers of personal four years and will include a sunset data to the UK in Chapter V of the GDPR;

PE691.441v01-00 84/88 AM\1229955EN.docx EN clause, and calls on the Commission to recalls that in line with EDPB Guidelines, keep monitoring the level of data transfers relying on derogations for protection in the UK in law and practice specific situations pursuant to Article 49 in the meantime; GDPR must be exceptional;

Or. en

Amendment 154 Moritz Körner, Michal Šimečka, Jan-Christoph Oetjen, Sophia in 't Veld, Olivier Chastel

Draft motion for a resolution Paragraph 26

Draft motion for a resolution Amendment

26. Welcomes the fact that the 26. Believes that every adequacy adequacy decision will be reviewed every decision should include a sunset clause, four years and will include a sunset clause, and calls on the Commission to keep and calls on the Commission to keep monitoring the level of data protection in monitoring the level of data protection in third countries in law and practice; the UK in law and practice in the meantime;

Or. en

Amendment 155 Sophia in 't Veld

Draft motion for a resolution Paragraph 26 a (new)

Draft motion for a resolution Amendment

26 a. Regrets that the Commission has ignored Parliament's calls to suspend the Privacy Shield until the US authorities comply with its terms, but has instead always preferred to "monitor the situation" without any concrete result in terms of data protection for citizens and legal certainty for businesses; urges the Commission to learn from its past failures to ignore calls from Parliament and experts with regards to the conclusion and monitoring of past adequacy decisions,

AM\1229955EN.docx 85/88 PE691.441v01-00 EN and to leave proper enforcement of EU data protection law to the Court of Justice of the European Union following complaints by individual citizens; calls on the Commission to amend, suspend and/or repeal the future adequacy decisions for the UK if Parliament calls for this;

Or. en

Amendment 156 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 26 a (new)

Draft motion for a resolution Amendment

26 a. Calls on the Commission to adopt a new adequacy decision on time, that is before the end of the interim period, in order to avoid any disruptions for European companies or transfers for law enforcement purposes;

Or. en

Amendment 157 Gwendoline Delbos-Corfield

Draft motion for a resolution Paragraph 27

Draft motion for a resolution Amendment

27. Calls for the Commission to consult 27. Calls on the Commission to closely with Parliament on any future changes to monitor the data protection law and the UK data protection regime, and for a practices in the UK; Calls for the scrutiny role for Parliament in the new Commission to consult with Parliament on institutional framework, including for any future changes to the UK data relevant bodies such as the Specialised protection regime, and for a scrutiny role Committee on Law Enforcement and for Parliament in the new institutional Judicial Cooperation; framework, including for relevant bodies such as the Specialised Committee on Law Enforcement and Judicial Cooperation;

PE691.441v01-00 86/88 AM\1229955EN.docx EN Or. en

Amendment 158 Sophia in 't Veld

Draft motion for a resolution Paragraph 27

Draft motion for a resolution Amendment

27. Calls for the Commission to consult 27. Calls for the Commission to with Parliament on any future changes to immediately inform and consult with the UK data protection regime, and for a Parliament on any future changes to the scrutiny role for Parliament in the new UK data protection regime, and for a institutional framework, including for scrutiny role for Parliament in the new relevant bodies such as the Specialised institutional framework, including for Committee on Law Enforcement and relevant bodies such as the Specialised Judicial Cooperation; Committee on Law Enforcement and Judicial Cooperation;

Or. en

Amendment 159 Assita Kanko

Draft motion for a resolution Paragraph 27

Draft motion for a resolution Amendment

27. Calls for the Commission to consult 27. Calls for the Commission to consult with Parliament on any future changes to with Parliament on any future changes to the UK data protection regime, and for a the UK data protection regime, and for scrutiny role for Parliament in the new an appropriate role for Parliament in the institutional framework, including for new institutional framework, including relevant bodies such as the Specialised regarding relevant bodies such as the Committee on Law Enforcement and Specialised Committee on Law Judicial Cooperation; Enforcement and Judicial Cooperation;

Or. en

Amendment 160 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

AM\1229955EN.docx 87/88 PE691.441v01-00 EN Draft motion for a resolution Paragraph 27

Draft motion for a resolution Amendment

27. Calls for the Commission to 27. Calls for the Commission to keep consult with Parliament on any future the Parliament informed about and changes to the UK data protection regime, consider its position on any relevant future and for a scrutiny role for Parliament in changes to the UK data protection regime the new institutional framework, as well as about related discussions in including for relevant bodies such as the relevant bodies such as the Specialised Specialised Committee on Law Committee on Law Enforcement and Enforcement and Judicial Cooperation; Judicial Cooperation;

Or. en

Amendment 161 Tom Vandenkendelaere, Axel Voss, Jeroen Lenaers

Draft motion for a resolution Paragraph 27 a (new)

Draft motion for a resolution Amendment

27 a. Considers, based on the information available, the level of protection currently afforded to personal data under UK law and practice to be essentially equivalent to that in the EU; expresses, therefore, its support for the two draft implementing decisions of the Commission on the adequate protection of personal data by the United Kingdom, respectively under the GDPR and the LED;

Or. en

PE691.441v01-00 88/88 AM\1229955EN.docx EN