Changes from plenary report to adopted text

Removed2. The policy implementation support project shall set out:

Removed(a) the existing Interoperable Europe solutions deemed necessary for the digital implementation of the policy requirements;

Removed(b) any missing interoperability solutions to be developed, deemed necessary for the digital implementation of the policy requirements;

Removed(c) other recommended support measures, such as trainings, sharing of expertise or peer-reviews;

Removed(ca) financial support opportunities to assist the implementation of interoperability solutions.

Removed3. The Commission shall set out, after consulting the Interoperable Europe Board, the scope, the timeline, the needed involvement of sectors and administrative levels and the working methods of the support project. If the Commission has already performed and published an interoperability assessment, in accordance with Article 3, the outcome of that assessment shall be taken into account when setting up the support project.

Removed4. In order to reinforce the policy implementation support project, the Interoperable Europe Board may propose to establish a innovation sandbox as referred to in Article 11.

Removed5. The outcome of a policy implementation support project as well as interoperability solutions developed in the project shall be openly available and made public on the Interoperable Europe Portal.

RemovedInnovation measures

Removed1. The Interoperable Europe Board may propose to the Commission to set up innovation measures to support the development and uptake of innovative interoperability solutions in the EU (‘innovation measures’).

Removed2. Innovation measures shall:

Removed(a) contribute to the development of existing or new Interoperable Europe solutions also as a prerequisite of an open ICT ecosystem;

Removed(aa) provide technological changes through incremental innovation on existing products and services, combining systems, components or applications;

Removed(b) involve GovTech and CivicTech actors.

Removed3. In order to support the development of innovation measures, the Interoperable Europe Board may propose to set up innovation sandboxes , with the aim of offering innovative public services to citizens.

Removed4. The Commission shall make the results from the innovation measures openly available on the Interoperable Europe portal.

RemovedEstablishment of innovation sandboxes

Removed1. Innovation sandboxes shall provide a controlled environment for the development, testing and validation of innovative interoperability solutions ▌for a limited period of time before putting them into service, with the aim of offering innovative public services to citizens and businesses.

Removed2. Innovation sandboxes shall be operated under the responsibility of the participating public sector bodies or Union institutions, bodies, offices and agencies and, where the sandbox is authorised to process personal data by public sector bodies, under the supervision of other relevant national, regional or local supervisory authorities, or where the sandbox is authorised to process personal data by institutions, bodies, and agencies of the Union, under supervisionof the European Data Protection Supervisor.

Removed3. The establishment of a innovation sandbox as set out in paragraph 1 shall aim to contribute to the following objectives:

Removed(a) foster innovation and facilitate the development and roll-out of innovative digital interoperability solutions for public services;

Removed(b) facilitate cross-border cooperation between national regional and local competent authorities and synergies in public service delivery;

Removed(c) facilitate the development of an open European GovTech ecosystem, including cooperation with small and medium enterprises, research and educational institutions and start-ups;

Removed(d) enhance authorities’ understanding of the opportunities or barriers to cross-border interoperability of innovative interoperability solutions, including legal or infrastructure barriers;

Removed(e) contribute to the development or update of Interoperable Europe solutions.

Removed4. The establishment of innovation sandboxes shall contribute to improving legal certainty through cooperation with the authorities involved in the innovation sandbox with a view to ensuring compliance with this Regulation and, where appropriate, with other Union and Member States legislation.

Removed4a. In order to ensure a harmonised approach and support the implementation of innovation sandboxes, the Commission may issue guidelines and clarifications, without prejudice to the provisions of other Union legal acts that apply in the course of the implementation of this Regulation. In particular, where a sector-specific Union legal act requires the participants in an innovation sandbox to comply with specific additional legal, technical, administrative or organisational requirements, the relevant provisions of that sector-specific Union legal act shall also apply.

Removed5. The Commission, after consulting the Interoperable Europe Board and, where the innovation sandbox would include the processing of personal data, the European Data Protection Supervisor, shall upon joint request from at least three participating public sector bodies authorise the establishment of a innovation sandbox. Where appropriate the request shall specify information such as the purpose of the processing of personal data, the actors involved and their roles, the categories of personal data concerned, and their source(s) and the envisaged retention period. This consultation shallnot replace the prior consultation referred to in Article 36 of Regulation (EU) 2016/679 and in Article 40 of Regulation (EU) 2018/1725. Where the sandbox is set up for interoperability solutions supporting the cross-border interoperability of network and information systems which are used to provide or manage public services to be delivered or managed electronically by one or more institutions, bodies or agencies of the Union, eventually with the participation of public sector bodies, no authorisation shall beneeded.

RemovedParticipation in the innovationy sandboxes

Removed1. The participating public sector bodies shall ensure that, to the extent the innovative interoperability solution involves the processing of personal data or otherwise falls under the supervisory remit of other national, regional or local authorities providing or supporting access to data, the national data protection authorities and those other national, regional or local authorities are associated to the operation of the innovation sandbox. As appropriate, the participating public sector bodies may allow for the involvement in the innovation sandbox of other actors within the GovTech ecosystem such as national or European standardisation organisations, notified bodies, research and experimentation labs, innovation hubs, and companies wishing to test innovative interoperability solutions, in particular SMEs and start-ups. Cooperation may only be envisaged with third countries establishing mechanisms to support innovative interoperability solutions for the public sector, provided that safeguards concerning data protection are envisioned.

Removed2. Participation in the innovation sandbox shall be limited to a period that is appropriate to the complexity and scale of the project, and in any case not longer than 2 years from the establishment of the innovation sandbox. The participation may be extended for up to 6 monthsif necessary to achieve the purpose of the processing.

Removed3. Participation in the innovation sandbox shall be based on a specific plan elaborated by the participants taking into account the advice of other national competent authorities or the European Data Protection Supervisor, as applicable. The plan shall contain as a minimum the following:

Removed(a) description of the participants involved and their roles, the envisaged innovative interoperability solution and its intended purpose, and relevant development, testing and validation process;

Removed(b) the specific innovation issues at stake and the guidance that is expected from the authorities supervising the innovation sandbox;

Removed(c) the specific modalities of the collaboration between the participants and the supervisory authorities, as well as any other actor involved in the innovation sandbox;

Removed(d) a risk management and monitoring mechanism to identify, prevent and mitigate any risk;

Removed(e) the key milestones to be completed by the participants for the interoperability solution to be considered ready to be put into service;

Removed(f) evaluation and reporting requirements and possible follow-up;

Removed(g) where it is strictly necessary and proportionate to process personal data, the reasons for such processing, an indication of the categories of personal data concerned, the purposes of the processing for which the personal data are intended, the controllers, processors and recipients involved in the processing and their role.

Removed4. The participation in the innovation sandboxes shall not affect the supervisory and corrective powers of any authorities supervising the sandbox.

Removed5. Participants in the innovation sandbox shall remain liable under applicable Union law and Member States legislation on liability for any damage caused in the course of their participation in the innovation sandbox.

Removed6. Personal data may only be processed in the innovation sandbox subject to the following cumulative conditions:

Removed(a) the innovative interoperability solution is developed for safeguarding public interests in the area of a high level of efficiency and quality of public administration and public services;

Removed(b) the data processed is limited to what is necessary for the functioning of the interoperability solution to be developed or tested in the sandbox, and the functioning cannot be effectively achieved by processing anonymised, synthetic or other non-personal data;

Removed(c) there are effective monitoring mechanisms to identify if any high risks to the rights and freedoms of the data subjects, as referred to in Article 35(1) of Regulation (EU) 2016/679 and in Article 39 of Regulation (EU) 2018/1725, may arise during the operation of the sandbox, as well as a response mechanism to promptly mitigate those risks and, where necessary, stop the processing;

Removed(d) any personal data to be processed are in a functionally separate, isolated and protected data processing environment under the control of the participants and only duly authorised persons have access to that data;

Removed(e) any personal data processed are not to be transmitted, transferred or otherwise accessed by other parties that are not participants in the sandbox nor transferred to parties other than the participants of the sandbox;

Removed(f) ▌ the application of the rights of the data subjects as provided for under Union law on the protection of personal data, ▌is fully ensured by participants in the sandbox, including through appropriate technical and organisational arrangements;

Removed(fa) personal data are not processed for purposes other than those for which the personal data were initially collected;

Removed(g) any personal data processed are protected by means of appropriate technical and organisational measures and deleted once the participation in the sandbox has terminated or the personal data has reached the end of its retention period;

Removed(h) the logs of the processing of personal data are kept for the duration of the participation in the sandbox and for a limited period after its termination solely for the purpose of and only as long as necessary for fulfilling accountability and documentation obligations under Union or Member States legislation;

Removed(i) a complete and detailed description of the process and rationale behind the training, testing and validation of the interoperability solution is kept together with the testing results as part of the technical documentation and transmitted to the Interoperable Europe Board;

Removed(j) a short summary of the interoperability solution developed in the sandbox, its objectives and expected results are made available on the Interoperable Europe portal.

Removed7. The participating public sector bodies or Union institutions, bodies, offices and agencies shall submit periodic reports and a final report to the Interoperable Europe Board and the Commission on the results from the innovation sandboxes, including good practices, lessons learnt and recommendations on their setup and, where relevant, on the development of this Regulation and other Union legislation supervised within the innovation sandbox. The Interoperable Europe Board shall issue an opinion to the Commission on the outcome of the innovation sandbox, specifying, where applicable, the actions needed to implement new interoperability solutions to promote the cross-border interoperability of network and information systems which are used to provide or manage public services to be delivered or managed electronically.

Removed8. The Commission shall ensure that information on the innovation sandboxes is available on the Interoperable Europe portal.

Removed9. The Commission is empowered to adopt implementing acts to set out the detailed rules and the conditions for the establishment and the operation of the innovation sandboxes, including the eligibility criteria and the procedure for the application for, selection of, participation in and exiting from the sandbox, and the rights and obligations of the participants.

Removed10. Where a innovation sandbox involves the use of artificial intelligence, the rules set out under Article 53 and 54 of the [proposal for a] Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) and amending certain Union legislative acts shall prevail in case of conflict with the rules set out by the Regulation.

RemovedTraining

Removed1. The Commission, assisted by the Interoperable Europe Board, shall provide training material on the use of the EIF and on Interoperable Europe solutions, including on free and open source solutions. Public sector bodies and institutions, bodies and agencies of the Union shall provide their staff entrusted with strategical or operational tasks having an impact on network and information systems in the Union with appropriate training programmes concerning interoperability issues.

Removed2. The Commission shall organise free of charge training courses on interoperability issues at Union level to enhance cooperation and the exchange of best practices between the staff of public sector bodies, institutions, bodies and agencies of the Union. The courses targeted at decision-makers and practitioners shall be announced in all official languages of the institutions of the Union on the Interoperable Europe portal ▌.