Elena Donazzan

Text proposed by the Commission

Amendment

(32a) Processing of personal data strictly necessary for professional communications between legal persons and their representatives shall be assessed taking into account the legitimate expectations of the parties and the specific characteristics of business-to-business relationships.

Text proposed by the Commission

Amendment

(32b) The processing of operational data generated by connected industrial equipment, including machine-to-machine communications, remote maintenance, technical diagnostics and cybersecurity operations, shall be distinguished from consumer-facing digital services. Where personal data are involved, the application of this Regulation should take due account of the specific industrial context and the demonstrably lower risk to the rights and freedoms of natural persons, without prejudice to the safeguards provided for in this Regulation.

Text proposed by the Commission

(48) Article 4 of Directive 2002/58/EC should be repealed. Article 4 of Directive 2002/58/EC sets requirements for providers of publicly available electronic communications services as regards safeguarding the security of their services and notification requirements. Subsequently, Directive (EU) 2022/2555 has set new requirements as regards cybersecurity risk-management measures and incident reporting for those providers. In order to reduce overlapping obligations for entities in the electronic communications sector, Article 4 of Directive 2002/58/EC should be repealed. As regards the security of processing of personal data pursuant to Article 4(1) and (1a) of this directive and the notification of personal data breaches pursuant to Article 4(3) to (5) of Directive 2002/58/EC this directive, the Regulation (EU) 2016/679 already provide for comprehensive and up-to-date rules. These rules should therefore apply to providers of publicly available electronic communication services and providers of public communications networks, thereby ensuring that one regime applies to the controllers and processors.

Amendment

(48) Article 4 of Directive 2002/58/EC should be repealed. Article 4 of Directive 2002/58/EC sets requirements for providers of publicly available electronic communications services as regards safeguarding the security of their services and notification requirements. Subsequently, Directive (EU) 2022/2555 has set new requirements as regards cybersecurity risk-management measures and incident reporting for those providers. In order to reduce overlapping obligations for entities in the electronic communications sector, Article 4 of Directive 2002/58/EC should be repealed. As regards the security of processing of personal data pursuant to Article 4(1) and (1a) of this directive and the notification of personal data breaches pursuant to Article 4(3) to (5) of Directive 2002/58/EC this directive, the Regulation (EU) 2016/679 already provide for comprehensive and up-to-date rules. These rules should therefore apply to providers of publicly available electronic communication services and providers of public communications networks, thereby ensuring that one regime applies to the controllers and processors. The fragmented legal requirements in cybersecurity shall be consolidated into harmonized, single-entry-point reporting systems.

Text proposed by the Commission

Amendment

In Article 88c, the following paragraph is added: '2a. When assessing the compliance of processing for the development, testing, validation or operation of artificial intelligence systems, competent authorities shall take due account of the actual availability of harmonised standards, common specifications, technical guidance and supporting compliance tools necessary for the effective implementation of the applicable obligations. The application timeline for high-risk AI obligations should be aligned with the actual current availability of technical standards and supporting tools.'

Text proposed by the Commission

Amendment

After Article 88c, the following article is inserted: 'Article 88d 1. The Commission and the European Data Protection Board shall develop voluntary, standardised and machine-readable templates tailored to SMEs for the fulfilment of information, documentation and notification obligations under this Regulation. 2. Supervisory authorities shall provide accessible and proportionate guidance channels for SMEs, taking due account of their administrative and financial capacity when determining practical compliance measures. 3. The measures referred to in paragraphs 1 and 2 shall be without prejudice to the responsibility of controllers and processors to comply with this Regulation.'