Changes from report parliamentary committee draft to plenary report

RemovedJoint Opinion of the EDPB and the EDPS 04/2022 (point 107 and 108)

AddedArticle 43 – paragraph 1 – point 6 – point b: (b) supporting the development and dissemination of research and expertise on those matters and on assistance and support to victims, taking into account the gender and age dimension and operating in a way that minimises risks to victims, specially children, including by: / i) serving as a hub of expertise to support evidence-based policy and by linking researchers to practitioners; / ii) acting on behalf of supporting victims in liaising with other relevant authorities of the Member States for reparations and all other victim support programmes; / iii) referring victims to the appropriate national child protection services and to pro bono legal support services; / iv) facilitating access to qualified health care support services, including mental health and psychological support; / v) supporting the collaboration of victim support services and elaborating best practices;

RemovedArticle 50 – paragraph 2 – point c: (c) information resulting from research or other activities conducted by Member States’ authorities, other Union institutions, bodies, offices and agencies, the competent authorities of third countries, international organisations, research centres, hotlines, and civil society organisations.

AddedArticle 43 – paragraph 1 – point 6 – point c a (new): (c a) create, maintain and operate the online European Child Protection Platform established by Article 54a.

RemovedArticle 50 – paragraph 5: 5. The EU Centre shall develop a communication strategy and promote dialogue and cooperation with civil society organisations, public authorities, and relevant information society services to raise public awareness of online child sexual abuse and measures to prevent and combat such abuse.

AddedArticle 44 – title: European Union Databases of hashes and indicators

RemovedArticle 51 – paragraph 3: 3. The EU Centre shall store the personal data referred to in paragraph 2 only where and for as long as strictly necessary for the applicable purposes listed in paragraph 2. The maximum retention period for the storage of those data shall not exceed 24 months. After that period, the EU Centre shall review the necessity of continued storage of that data and provide justification for another 24 months maximum prolonged retention.

AddedArticle 44 – paragraph 2 – point a: (a) relevant indicators, consisting of digital identifiers to be used to detect the dissemination of known or new child sexual abuse material or the solicitation of children, as applicable, on hosting services and number-independent interpersonal communications services, generated by the EU Centre in accordance with paragraph 3;

RemovedJoint Opinion of the EDPB and the EDPS 04/2022 (point 115)

AddedArticle 44 – paragraph 3 – subparagraph 1: The EU Centre shall generate the indicators referred to in paragraph 2, point (a), solely on the basis of the child sexual abuse material and the solicitation of children identified as such by the Coordinating Authorities or the courts or other independent authorities of the Member States subject to judicial validation, submitted to it by the Coordinating Authorities pursuant to Article 36(1), point (a).

RemovedArticle 51 – paragraph 4: 4. It shall ensure that the personal data is stored in a secure manner and that the storage is subject to appropriate technical and organisational safeguards that ensure an effective supervision, especially in automated processing systems. Those safeguards shall ensure, in particular, that the personal data can be accessed and processed only for the purpose for which it is stored, that a high level of security is achieved and that the personal data is deleted when no longer strictly necessary for the applicable purposes. It shall regularly review those safeguards and adjust them where necessary. It shall maintain a record of processing activities as established in Article 30 of Regulation (EU) 2016/679 which, upon request, would be made available to the EU Centre’s data protection officer and to the European Data Protection Supervisor.

AddedArticle 44 – paragraph 4 a (new): 4 a. The EU Centre shall ensure through all technical means available that the databases of indicators are secure and the content cannot be altered by any other actor.

RemovedJoint Opinion of the EDPB and the EDPS 04/2022 (point 116)

AddedArticle 45 – paragraph 1: 1. The EU Centre shall create, maintain and operate a database for the reports submitted to it by providers of hosting services and providers of number-independent interpersonal communications services in accordance with Article 12(1) and assessed and processed in accordance with Article 48.

RemovedArticle 53 – paragraph 2 – subparagraph 1: Europol shall provide the EU Centre with access to relevant information and information systems, where deemed strictly necessary for the performance of the EU Centre’s tasks. Any access to personal data processed in Europol’s information systems shall be granted only on a case-by-case basis, upon submission of an explicit request, which documents the specific purpose, and justification. Europol should be required to diligently assess those requests and only transmit personal data to the EU Centre where strictly necessary and proportionate to the required purpose. / The EU Centre shall provide Europol with access to relevant information and information systems where deemed strictly necessary for the performance of Europol’s tasks. That access and subsequent transmission of personal data obtained from the EU Centre’s information systems should only take place on a case-by-case basis, following a duly assessed request, via an available secure exchange communication tool.

AddedArticle 45 – paragraph 2 – point b: deleted

RemovedJoint Opinion of the EDPB and the EDPS 04/2022 (point 127-133)

AddedArticle 45 – paragraph 2 – subparagraph 1 (new): Where the EU Centre considered the report manifestly unfounded, all data shall be anonymized and in case of videos or images only a cryptographic hash value from the reported file, the reasons and the date and time of informing the provider in accordance with Article 48(2) shall be stored;

RemovedArticle 53 – paragraph 2 – subparagraph 2: Without prejudice to the responsibilities of the Executive Director, the EU Centre shall maximise efficiency by sharing, where possible, support functions with Europol and information technology services (IT).

AddedArticle 46 – paragraph 2: 2. The EU Centre shall give providers of hosting services, providers of interpersonal communications services and providers of internet access services access to the databases of indicators referred to in Article 44(1) points (a) and (b), where and to the extent necessary for them to execute the detection, blocking orders that they received in accordance with Articles 5a, 7, 16. The EU Centre shall take measures to ensure that such access remains limited to what is strictly necessary for the period of application of the detection, blocking orders concerned and that such access does not in any way endanger the proper operation of those databases and the accuracy and security of the data contained therein.

Change 75

ChangedArticle 5446 – paragraph 1: 1. Where necessary5: for5. theThe performanceEU ofCentre itsshall tasksgive underEuropol thisaccess Regulation,to the EU Centre may cooperatedatabases withof organisationsreports andwhich networksit withconsidered informationnot andunfounded expertiseas onreferred mattersto relatedin toArticle the45, preventionwhere and combatingto ofthe onlineextent childnecessary sexualfor abuse,the includingperformance civilof societyits organisationstasks actingof inassisting theinvestigations publicof interestchild andsexual semi-publicabuse organisations.offences.

Change 76

RemovedArticle 56 – paragraph 4: 4. Members of the Management Board and their alternates shall be appointed in the light of their knowledge in the field of combating child sexual abuse, taking into account expertise and profesional records. Member States shall appoint a representative of their Coordinating Authority, within four months of [date of entry into force of this Regulation]. All parties shall aim to achieve a balanced representation between men and women on the Management Board.

AddedArticle 46 – paragraph 6 – subparagraph 2: The EU Centre shall diligently assess those requests on a case-by-case basis and only grant access where it considers that the requested access is necessary for and proportionate to the specified purpose, and in accordance with the Union law. Where it considers that an access request by Europol is necessary and proportionate, it shall transmit the relevant data via an available secure exchange communication tool, such as the Secure Information Exchange Network Application (SIENA).

RemovedArticle 56 – paragraph 5: 5. The term of office for members and their alternates shall be four years. That term may be renewed only once for another four years term.

AddedArticle 46 – paragraph 8: 8. The EU Centre shall ensure that the data contained in the databases referred to in Articles 44 and 45 is stored in a secure manner and that the storage is subject to highest state of the art technical and organisational safeguards, that ensure an effective supervision. Those safeguards shall ensure, in particular, that the data can be accessed and processed only by duly authorised persons for the purpose for which the person is authorised and that a high level of security is achieved. The EU Centre shall regularly review those safeguards and adjust them where necessary.

AddedArticle 47 – paragraph 1 – point d: (d) the modalities of the access to the databases referred to in Articles 44 and 45 in accordance with Article 46(1) to (5), the content, processing and assessment of the requests in accordance with Article 46(6), procedural matters related to such requests and the necessary measures in accordance with Article 46(6);

AddedArticle 48 – paragraph 1: 1. The EU Centre shall expeditiously and accurately assess and process reports submitted by providers of hosting services and providers of number-independent, interpersonal communications services in accordance with Article 12 to determine whether the reports are unfounded or not.

AddedArticle 48 – paragraph 2: 2. Where the EU Centre considers that the report is unfounded, it shall inform the provider that submitted the report, specifying the reasons why it considers the report to be unfounded.

AddedArticle 48 – paragraph 3 – subparagraph 1: Where, after a thorough legal and factual assessment, the EU Centre considers that a report is not unfounded, it shall forward the report, together with any additional relevant information available to it, to Europol and to the competent law enforcement authority or authorities of the Member State likely to have jurisdiction to investigate or prosecute the potential child sexual abuse to which the report relates.

AddedArticle 48 – paragraph 3 – subparagraph 2: Where that competent law enforcement authority or those competent law enforcement authorities cannot be determined with sufficient certainty by a thorough factual assessment, the EU Centre shall forward the report, together with any additional relevant information available to it, to Europol, for further analysis and subsequent referral by Europol to the competent law enforcement authority or authorities.

AddedArticle 48 – paragraph 7: 7. The time periods referred to in paragraph 6, points (a) and (b), shall be those specified in the competent law enforcement authority’s request to the EU Centre, provided that they remain limited to what is necessary and proportionate to safeguard the prevention, detection, investigation and prosecution of child sexual abuse offences in a specific case These time periods shall not in any case exceed 12 months.

AddedArticle 49 – paragraph 1 – introductory part: 1. The EU Centre shall have the power to conduct searches of publicly accessible content on hosting services for child sexual abuse material, using the relevant indicators from the database of indicators referred to in Article 44(1), points (a) and (b), in the following situations:

AddedArticle 49 – paragraph 1 – point b a (new): (b a) proactively on its own initiative for known child sexual abuse material. The European Data Protection Board shall issue guidelines regarding the compliance with Regulation (EU) 2016/679 of existing and future technologies that are used for this purpose.

AddedArticle 49 – paragraph 1 a (new): 1 a. The technologies used by the EU Centre to conduct the searches referred to in paragraph 1 shall comply with the requirements set out in Article 10 (3).

AddedArticle 49 – paragraph 2 – subparagraph 1: The EU Centre shall notify, after having conducted the searches referred to in paragraph 1 (a) and (b), providers of hosting services of the presence of one or more specific items of known child sexual abuse material on their services and request them to remove or disable access to that item or those items, for the providers’ voluntary consideration.

AddedArticle 49 – paragraph 2 – subparagraph 2 a (new): After having conducted the searches referred to in paragraph 1 (ba), the EU Centre shall notify the competent Coordinating Authority which shall request the provider to remove or disable access to that item or those items pursuant to Article 32 or request a removal order pursuant to Article 14.

AddedArticle 49 – paragraph 3: 3. Where it is necessary and proportionate to safeguard the prevention, detection, investigation and prosecution of child sexual abuse offences in a specific case and where requested by a competent law enforcement authority of a Member State, the EU Centre shall not proceed according to paragraph 2. This non-submission shall be in any case no longer than 12 months.

AddedArticle 50 – paragraph 1 – subparagraph 1: The EU Centre shall make available technologies that providers of hosting services and providers of number-independent interpersonal communications services may acquire, install and operate, free of charge, where relevant subject to reasonable licensing conditions, to execute detection orders in accordance with Article 10(1). The EU Centre shall make available tools, technologies and relevant best practices for the implementation of the mitigation measures referred to in Article 4 of this Regulation. The EU Centre shall make publicly available the relevant information related to the making available of these technologies or tools, including the names of the manufacturers of the technologies.

AddedArticle 50 – paragraph 1 – subparagraph 3: Before including specific technologies on those lists, the EU Centre shall request the opinions of its Technology Committee and Victims’ Rights and Survivors Consultative Forum, and through the European Commission, the opinion of the European Data Protection Board. The Technology Committee, the Victims’ Consultative Forum and the European Data Protection Board shall deliver their respective opinions within eight weeks. That period may be extended by a further six weeks where necessary, taking into account the complexity of the subject matter. The Technology Committee and the European Data Protection Board shall inform the EU Centre of any such extension within one month of receipt of the request for consultation, together with the reasons for the delay. Where the EU Centre substantially deviates from those opinions, it shall inform, where applicable, the Technology Committee, the Victims’ Rights and Survivors Consultative Forum, or the European Data Protection Board and the Commission thereof, specifying the points where it deviated and the main reasons for that deviation.

AddedArticle 50 – paragraph 2 – introductory part: 2. The EU Centre shall collect, record, aggregate, analyse and proactively make available relevant, objective, reliable and comparable information on matters related to the prevention and combating of child sexual abuse, in particular:

AddedArticle 50 – paragraph 2 – point c: (c) information resulting from research or other activities conducted by Member States’ authorities, other Union institutions, bodies, offices and agencies, the competent authorities of third countries, international organisations, research centres, hotlines, helplines and civil society organisations.

AddedArticle 50 – paragraph 2 – point c a (new): (c a) information obtained in the performance of its tasks under this Regulation concerning victim assistance and support.

AddedArticle 50 – paragraph 3: 3. Where necessary for the performance of its tasks under this Regulation, the EU Centre shall carry out, participate in or encourage research, surveys and studies, either on its own initiative or, where appropriate and compatible with its priorities and its annual work programme, at the request of the European Parliament, the Council or the Commission. The outcome of the research, surveys and studies referred to in this paragraph, including its analysis thereof, shall be made publicly available.

AddedArticle 50 – paragraph 3 a (new): 3 a. The EU Centre shall support Member States and the Coordinating Authorities in conducting research, taking into account age, gender, vulnerable groups and national specificities. The collected knowledge shall serve as a tool to elaborate prevention methods adapted and implemented by Coordinating Authorities in each Member State.

AddedArticle 50 – paragraph 4: 4. The EU Centre shall provide the information referred to in paragraph 2 and its opinions on matters related to the prevention and combating of online child sexual abuse to other Union institutions, bodies, offices and agencies, Coordinating Authorities, other competent authorities and other public authorities of the Member States, either on its own initiative or at request of the relevant authority. Where appropriate, the EU Centre shall make such information publicly available.

AddedArticle 50 – paragraph 5: 5. The EU Centre shall develop a communication strategy and promote dialogue and cooperation with civil society organisations, hotlines, helplines, public authorities, and relevant information society services to raise public awareness of online child sexual abuse and measures to prevent and combat such abuse. Communication campaigns shall be easily understandable and accessible to all children, their families and educators in formal and non-formal education in the Union, aiming to improve digital literacy and ensure a safe digital environment for children. Communication campaigns shall take into account the gender dimension of the crime and the contributions of the Victims’ Rights and Survivors Consultative Forum.

AddedArticle 50 – paragraph 5 a (new): 5 a. The EU Centre shall support the development of technologies to detect the dissemination of online child sexual material, having regard to the requirements of this Regulation and in particular those under Article 10(3), and make them, free and open source, available for relevant information society services. The EU Centre shall make publicly available the relevant information related to the support it provides, including the names of the manufacturers of the technologies.

AddedArticle 51 – paragraph 4: 4. It shall ensure that the personal data is stored in a secure manner and that the storage is subject to highest state of the art, technical and organisational safeguards. Security requirements for data security pursuant to Article 88 of Regulation (EU) 2018/1725, Article 32 of Regulation (EU) 767/2008, Article 16 of Regulation (EU) 1987/2006, Article 16 of Regulation (EU) 2018/1862 and Article 34 of Regulation (EU) 603/2013 shall apply accordingly. Those safeguards shall ensure, in particular, that the personal data can be accessed and processed only for the purpose for which it is stored, that a high level of security is achieved and that the personal data is deleted when no longer strictly necessary for the applicable purposes. It shall regularly review those safeguards and adjust them where necessary.

AddedArticle 51 a (new): Article51a / Logging / 1. The EU Centre shall provide for logs to be kept for at least the following processing operations, in relation to tasks performed under this Regulation: collection, alteration, consultation, disclosure including transfers, combination and erasure. / 2. The logs of consultation and disclosure shall make possible to establish the justification, date and time of such operations and, as far as possible, the identification of the person who consulted or disclosed the data, and the identity of the recipients of such data. / 3. The logs shall be used solely for verification of the lawfulness of processing, self-monitoring, ensuring the integrity and security of the personal data. / 4. The EU Centre shall make the logs available to the relevant data protection supervisory authority on request.

AddedArticle 52 – paragraph 4: 4. Costs that arise in connection with the designation of contact officers and the performance of their tasks shall be borne by the Coordinating Authority that designated them. Where contact officers are seconded to the EU Centre, the EU Centre shall cover the costs of office space in the building and adequate equipment for them to perform their duties.

AddedArticle 53 – paragraph 2 – subparagraph 1: Europol shall provide the EU Centre with (part. 1744 The Left) access to relevant information and information systems, where deemed strictly necessary for the performance of the EU Centre’s tasks and in accordance with the acts of Union law regulating that. Any access to personal data processed in Europol’s information systems shall be granted only on a case-by-case basis, upon submission of an explicit and justified request, which documents the specific purpose. Europol shall be required to diligently assess those requests and only transmit personal data to the EU Centre where strictly necessary and proportionate to the specified purpose. / The EU Centre shall provide Europol with access to relevant information where deemed strictly necessary for the performance of Europol’s tasks. Any access to personal data processed in the EU Centre’s information systems shall be granted only on a case-by-case basis, upon submission of an explicit and justified request, which documents the specific purpose. The EU Centre shall be required to diligently assess those requests and only transmit personal data to Europol where strictly necessary and proportionate to the specified purpose. / That access and subsequent transmission of personal data shall only take place via an available secure exchange communication tool, such as the Secure Information Exchange Network Application (SIENA).

AddedArticle 53 – paragraph 2 – subparagraph 2: deleted

AddedArticle 53 – paragraph 3: 3. The terms of cooperation and working arrangements shall be laid down in a publically accessible memorandum of understanding.

AddedArticle 54 – paragraph 1: 1. Where necessary for the performance of its tasks under this Regulation, the EU Centre shall cooperate with organisations and networks with information and expertise on matters related to the prevention and combating of online child sexual abuse, and victim support, including civil society organisations and semi-public organisations acting in the public interest, and professional organisations of practioners.

AddedArticle 54 – paragraph 2: 2. The EU Centre may conclude publically accessible memoranda of understanding with organisations referred to in paragraph 1, laying down the terms of cooperation.

AddedArticle 54 – paragraph 2 a (new): 2 a. The EU Centre shall cooperate with other organizations and bodies carrying out, in other jurisdictions, similar functions on matters related to the prevention and combating of online child sexual abuse and victim support, as well as in order to avoid potential duplication of reporting obligations for providers.

AddedArticle 54 a (new): Article 54a / Establishment of an online European Child Protection Platform / 1. The EU Centre shall create, maintain and operate an online platform for the presentation of information about Member States hotlines and helplines ('Child Protection Platform'). That platform may also be used for the promotion of awareness-raising and prevention campaigns. The platform shall be accessible 24 hours a day and seven days a week in all Union languages and shall be child-friendly, age-appropriate and accessible. / 2. Providers of hosting services and providers of number-independent interpersonal communications services shall, where relevant in order to fulfil their tasks as laid down in Article 4 paragraph 1 point (cc) of this Regulation, make reference to the Platform.

AddedArticle 55 – paragraph 1 – point d a (new): (d a) a Victims’ Rights and Survivors Consultative Forum which shall exercise the tasks set out in Article 66a.

AddedArticle 55 – paragraph 1 – point d b (new): (d b) a Fundamental Rights Officer, which shall exercise the tasks set out in Art. 66b.

AddedArticle 55 – paragraph 1 – subparagraph 1 (new): When appointing the members that compose these bodies, all parties involved shall aim for an appropiate gender representation.