Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data

Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC

In April of 2016, the European Parliament and the Council adopted the General Data Protection Regulation (GDPR) and the Directive for the protection of personal data in the area of law enforcement - which became applicable in May of 2018. Both legislative texts call for the alignment of Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data with the updated data protection rules and principles. To that end, the Commission adopted a proposal for a Regulation on 10 January 2017.

The European Data Protection Supervisor adopted its opinion on the proposal in March 2017, highlighting the need for consistency in the data protection rules regardless of who the data controller is. Commenting on the scope of the proposal, the EDPS noted that the “the fragmentation and increasing complexity of the legal framework for data processing by the various EU institutions active in the former first and third ‘pillars’ is not a fully satisfactory outcome”.

In October 2017, the LIBE Committee decided to open interinstitutional negotiations. It tabled its report for plenary in 23 October 2017. The Council, meanwhile, agreed on a general approach in June 2017. In the trialogues that followed, differences between the Parliament and the Council delayed the conclusion of an agreement. In particular, the Parliament wished to include data processing by agencies such as Europol and Eurojust in the scope of the Regulation, whereas the Council wanted to exempt them from its scope. On 26 March 2018, the Council presented a redrafted compromise text concerning the scope of the regulation and Member States commented on it. At the trilogue on 16 May 2018, the Presidency and the Rapporteur succeeded in solving most of the unresolved issues. In 18 May the Council presented an updated compromise text. Following a trilogue held on 23 May 2018, representatives of the Council and the European Parliament found agreement on an overall compromise text on the regulation. Eurojust is covered by the Regulation, whereas Europol and the EPPO are, for the time being, excluded. A review will be carried out by the Commission in 2022.

On 13 September 2018, the European Parliament adopted the text at first reading and on 11 October, the Council approved the Parliament’s position. On 23 October, the Act received the signature of the President of the European Parliament and of the Council and on 21 November it was published in the Official Journal of the European Union.