Changes from report parliamentary committee draft to plenary report

RemovedArticle 36 – paragraph 1 – subparagraph 2: Member States shall take the necessary measures to ensure that the Coordinating Authorities that they designated receive, without undue delay, the material identified as child sexual abuse material, the transcripts of conversations identified as the solicitation of children, and the Uniform Resource Identifiers, identified by a competent judicial authority or other independent administrative authority than the Coordinating Authority, for submission to the EU Centre in accordance with the first subparagraph.

AddedArticle 34 – paragraph 2: 2. Coordinating Authorities shall provide age-appropriate and accessible mechanisms to submit a complaint under this Article and adopt an age-appropriate and gender-sensitive approach when handling complaints taking due account of the complainant’s age, maturity, views, needs and concerns. Coordinating Authorities shall diligently process the complaints.

RemovedArticle 36 – paragraph 3: 3. Member States shall ensure that, where their law enforcement authorities receive a report of the dissemination of new child sexual abuse material or of the solicitation of children forwarded to them by the EU Centre in accordance with Article 48(3), a diligent assessment is conducted in accordance with paragraph 1.

AddedArticle 34 – paragraph 3 – subparagraph 1: The Coordinating Authority receiving the complaint shall assess the complaint and, where appropriate, transmit it to the Coordinating Authority of establishment of the provider. In this case paragraph 1a shall apply to the Coordinating Authorty of establishment mutandis mutandis.

RemovedArticle 38 – paragraph 1 – subparagraph 1: Coordinating Authorities shall share best practice standards and guidance on the detection and removal of child sexual abuse material and may participate in joint investigations, which may be coordinated with the support of the EU Centre, of matters covered by this Regulation, concerning providers of relevant information society services that offer their services in several Member States.

AddedArticle 34 a (new): Article 34a / Judicial remedy and compensation / Users and any body, organisation or association mandated to exercise the rights conferred by this Regulation on their behalf shall have the right to seek, in accordance with Union and national law, judicial remedy, including the right to compensation for any damage or loss suffered due to an infringement of the obligations under this Regulation.

RemovedArticle 39 – paragraph 1: 1. Coordinating Authorities shall cooperate with each other, any other competent authorities of the Member State that designated the Coordinating Authority, the Commission, the EU Centre, Europol and other relevant Union agencies, including the European Union Agency for Cybersecurity (ENISA), to facilitate the performance of their respective tasks under this Regulation and ensure its effective, efficient and consistent application and enforcement.

AddedArticle 35 – paragraph 2: 2. Member States shall ensure that the maximum amount of penalties imposed for an infringement of this Regulation shall not exceed 6 % of the annual worldwide turnover of the preceding business year of the provider.

RemovedArticle 39 – paragraph 2: 2. The EU Centre shall establish and maintain one or more reliable and secure information sharing systems supporting communications between Coordinating Authorities, the Commission, the EU Centre, Europol, and other relevant Union agencies, including ENISA, and providers of relevant information society services.

AddedArticle 35 – paragraph 3: 3. Penalties for the supply of incorrect, incomplete or misleading information, failure to reply or rectify incorrect, incomplete or misleading information or to submit to an on-site inspection shall not exceed 1% of the annual worldwide turnover of the preceding business year of the provider or the other person referred to in Article 27.

RemovedArticle 39 – paragraph 3: 3. The Coordinating Authorities, the Commission, the EU Centre, Europol, other relevant Union agencies, including ENISA, and providers of relevant information society services shall use the information-sharing systems referred to in paragraph 2 for all relevant communications pursuant to this Regulation.

AddedArticle 35 – paragraph 4: 4. Member States shall ensure that the maximum amount of a periodic penalty payment shall not exceed 5 % of the average daily worldwide turnover of the provider or the other person referred to in point (a) of Article 27(1), point (a) in the preceding financial year per day, calculated from the date specified in the decision concerned.

RemovedArticle 40 – paragraph 2: 2. The EU Centre shall contribute to the achievement of the objective of this Regulation by supporting and facilitating the implementation of its provisions concerning the prevention, detection, reporting, removal or disabling of access to, blocking of online child sexual abuse or delisting a particular resource indicating specific items of child sexual abuse material. The EU Centre shall gather and share information and expertise and facilitate cooperation between relevant public and private parties in connection to the prevention and combating of child sexual abuse, in particular online. It shall promote and ensure the appropriate support and assistance to victims.

AddedArticle 36 – paragraph 1 – subparagraph 1 – point a: (a) specific items of material and transcripts of conversations that Coordinating Authorities or that the competent judicial authorities or other independent administrative authorities of a Member State subject to judicial validation have identified, after a diligent assessment, as constituting child sexual abuse material or the solicitation of children, as applicable, for the EU Centre to generate indicators in accordance with Article 44(3);

RemovedArticle 42 – paragraph 1: The seat of the EU Centre shall be... / The choice of the location of the seat of the EU Centre shall be made in accordance with the ordinary legislative procedure, based on the following criteria: / (a) it shall not affect the EU Centre’s execution of its tasks or the organisation of its governance structure; / (b) it shall ensure that the EU Centre is able to recruit the high-qualified and specialised staff it requires to perform the tasks provided by this Regulation; / (c) it shall ensure that it can be set up on site upon the entry into force of this Regulation; / (d) it shall ensure appropriate accessibility of the location, the existence of adequate education facilities for the children of staff members, appropriate access to the labour market, social security and medical care for both children and spouses; / (e) it shall ensure a balanced geographical distribution of EU institutions, bodies and agencies across the Union; / (f) it shall enable close cooperation with EU institutions, bodies and agencies; / (g) it shall ensure sustainability and digital security and connectivity with regards to physical and IT infrastructure and working conditions.

AddedArticle 36 – paragraph 1 – subparagraph 1 – point b: (b) exact uniform resource locators indicating specific items of material that Coordinating Authorities or that competent judicial authorities or other independent administrative authorities of a Member State subject to judicial validation have identified, after a diligent assessment, as constituting child sexual abuse material, hosted by providers of hosting services not offering services in the Union, that cannot be removed due to those providers’ refusal to remove or disable access thereto and to the lack of cooperation by the competent authorities of the third country having jurisdiction, for the EU Centre to compile the list of uniform resource locators in accordance with Article 44(3).

RemovedArticle 43 – paragraph 1 – point 4 – point d: (d) providing information, assistance and support to victims in accordance with Articles 20 and 21;

AddedArticle 36 – paragraph 1 – subparagraph 2: Member States shall take the necessary measures to ensure that the Coordinating Authorities that they designated receive in a secure manner, without undue delay, the material identified as child sexual abuse material, the transcripts of conversations identified as the solicitation of children, and the uniform resource locators, identified by a competent judicial authority or other independent administrative authority than the Coordinating Authority, for submission to the EU Centre in accordance with the first subparagraph.

RemovedArticle 43 – paragraph 1 – point 6 – point b a (new): (ba) supporting the development and dissemination of age appropriate educational tools in order to enhance digital literacy and to raise awareness among users;

AddedArticle 36 – paragraph 4: 4. They shall also ensure that, where the diligent assessment indicates that the material does not constitute child sexual abuse material or the solicitation of children, the Coordinating Authority is informed of that outcome and subsequently informs the EU Centre thereof, within the time periods specified in the first subparagraph. Member States shall establish effective procedures that such material, including any associated data, which does not constitute child sexual abuse material or solicitation of children, is deleted from the records and databases at the Coordinating Authority and the Member States law enforcement authorities.

RemovedArticle 44 – paragraph 1 – point a: (a) indicators to prevent and detect the dissemination of child sexual abuse material previously detected and identified as constituting child sexual abuse material in accordance with Article 36(1);

AddedArticle 37 – paragraph 4: 4. The Coordinating Authority of establishment shall, without undue delay and in any event not later than two months following receipt of the request or recommendation referred to in paragraph 1, communicate to the Coordinating Authority that sent the request, or the Commission, the outcome of its assessment of the suspected infringement, or that of any other competent authority pursuant to national law where relevant, and, where applicable, details of the investigatory or enforcement measures taken or envisaged in relation thereto to ensure compliance with this Regulation.

RemovedArticle 44 – paragraph 1 – point b: (b) indicators to prevent and detect the dissemination of child sexual abuse material not previously detected and identified as constituting child sexual abuse material in accordance with Article 36(1);

AddedArticle 38 – paragraph 1 – subparagraph 1: Coordinating Authorities may participate in joint investigations, which may be coordinated with the support of the EU Centre, of matters covered by this Regulation, concerning providers of relevant information society services that offer their services in several Member States. Those investigations shall also take place on the darkweb.

RemovedArticle 44 – paragraph 1 – point c: (c) indicators to prevent and detect the solicitation of children.

AddedArticle 39 – paragraph 1: 1. Coordinating Authorities shall cooperate with each other, any other competent authorities of the Member State that designated the Coordinating Authority, the Commission, the EU Centre, and other relevant Union agencies, including to facilitate the performance of their respective tasks under this Regulation and ensure its effective, efficient and consistent application and enforcement.

RemovedArticle 44 – paragraph 2 – point b: (b) as regards paragraph 1, point (a), the relevant indicators shall include a list of Uniform Resource Identifiers compiled by the EU Centre in accordance with paragraph 3;

AddedArticle 39 – paragraph 2: 2. The EU Centre shall establish and maintain one or more reliable and secure information sharing systems suject to highest state of art technical and organisational safeguards, such as the software provided by eu-LISA pursuant to Regulation (EU) 2023/969, supporting communications between Coordinating Authorities, the Commission, the EU Centre, other relevant Union agencies and providers of relevant information society services.

RemovedArticle 44 – paragraph 3 – subparagraph 2: The EU Centre shall compile the list of Uniform Resource Identifiers referred to in paragraph 2, point (b), solely on the basis of the Uniform Resource Identifiers submitted to it pursuant to Article 36(1), point (b).

AddedArticle 39 – paragraph 4 a (new): 4 a. The Coordinating Authorities shall share information, best practice standards and guidance on the prevention and combating of child sexual abuse and solicitation of children.

RemovedArticle 44 – paragraph 4: 4. The EU Centre shall keep records of the submissions and of the process applied to generate the indicators and compile the list referred to in the first and second subparagraphs. It shall keep those records for as long as the indicators, including the Uniform Resource Identifiers, to which they correspond are contained in the databases of indicators referred to in paragraph 1.

AddedChapter IV – title: IV EU CENTRE FOR CHILD PROTECTION

RemovedArticle 45 – paragraph 2 – point g: (g) relevant indicators, metadata, and ancillary tags associated with the reported potential child sexual abuse material.

AddedArticle 40 – paragraph 1: 1. A European Union Agency to prevent and combat child sexual abuse, the EU Centre for child protection, is established.

RemovedArticle 46 – paragraph 2: 2. The EU Centre shall give relevant information society services providers access to the databases of indicators referred to in Article 44, where and to the extent necessary for them to execute the voluntary detection orders, detection, blocking or delisting orders that they received in accordance with Articles 5a, 7, 16 or 18a. The EU Centre shall take measures to ensure that such access remains limited to what is strictly necessary for the period of application of the voluntary detection orders, detection, blocking or delisting orders concerned and that such access does not in any way endanger the proper operation of those databases and the accuracy and security of the data contained therein.

AddedArticle 40 – paragraph 2: 2. The EU Centre shall contribute to the achievement of the objectives of this Regulation by supporting and facilitating the implementation of its provisions concerning the detection, reporting, removal or disabling of access to, and blocking of online child sexual abuse. The EU Centre shall gather and share anonymised information, gender-, and age-disaggregated statistics, and expertise, educational materials and best practices and facilitate cooperation between relevant public and private parties in connection to the prevention and combating of child sexual abuse, in particular online. It shall promote and ensure the appropriate support and assistance to victims.

RemovedArticle 46 – paragraph 4: 4. The EU Centre shall give Europol and the competent law enforcement authorities of the Member States access to the databases of indicators referred to in Article 44 where and to the extent necessary for the performance of their tasks of investigating child sexual abuse offences.

AddedArticle 42 – paragraph 1: The seat of the EU Centre shall be [...]

RemovedArticle 46 – paragraph 5: 5. The EU Centre shall give Europol access to the databases of reports referred to in Article 45, where and to the extent necessary for the performance of its tasks of assisting investigations of child sexual abuse offences

AddedArticle 42 – paragraph 1 a (new): The choice of the location of the seat of the EU Centre shall be made in accordance with the ordinary legislative procedure, based on the following criteria: / a) it shall not affect the EU Centre’s execution of its tasks and powers, the organisation of its governance structure, the operation of its main organisation, or the main financing of its activities; / b) it shall ensure that the EU Centre is able to recruit the high-qualified and specialised staff it requires to perform the tasks provided by this Regulation; / c) it shall ensure that it can be set up on site upon the entry into force of this Regulation; / d) it shall ensure appropriate accessibility of the location, the existence of adequate education facilities for the children of staff members, appropriate access to the labour market, social security and medical care for both children and spouses; / e) it shall ensure a balanced geographical distribution of EU institutions, bodies and agencies across the Union; / f) it shall enable close cooperation with EU institutions, bodies and agencies but it shall be independent of any of the aforementioned; / g) it shall ensure sustainability and digital security and connectivity with regards to physical and IT infrastructure and working conditions.

RemovedArticle 46 – paragraph 6 – subparagraph 1: The EU Centre shall provide the access referred to in paragraphs 2, 3, 4 and 5 only upon the reception of a request, specifying the purpose of the request, the modalities of the requested access, and the degree of access needed to achieve that purpose. The requests for the access referred to in paragraph 2 shall also include a reference to the voluntary detection orders, detection, blocking or delisting orders, as applicable.

AddedArticle 43 – paragraph 1 – point 1 – point a: (a) supporting the Commission in the preparation of the guidelines referred to in Article 3(6), Article 4(5), Article 6(4) and Article 11, including by collecting and providing relevant gender-sensitive and age-apropiate information, expertise and best practices, taking into account advice, from the Technology Committee referred to in Article 66 and from the Victims’ Rights and Survivors Consultative Forum referred to in Article 66a new where applicable;

RemovedArticle 46 – paragraph 6 – subparagraph 2: The EU Centre shall diligently assess those requests and only grant access where it considers that the requested access is necessary for and proportionate to the specified purpose, and in accordance with Union law.

AddedArticle 43 – paragraph 1 – point 1 – point b: (b) upon request from a provider of relevant information services, providing an analysis of methodology for risk assessment or, where appropiate, performing a test on;

RemovedArticle 46 – paragraph 7: 7. The EU Centre shall regularly verify that the data contained in the databases referred to in Articles 44 and 45 is, in all respects, complete, accurate and up-to-date and continues to be necessary for the purposes of reporting, detection and blocking in accordance with this Regulation, as well as facilitating and monitoring of accurate detection technologies and processes. In particular, as regards the Uniform Resource Identifiers contained in the database referred to Article 44(1), point (a), the EU Centre shall, where necessary in cooperation with the Coordination Authorities, regularly verify that the conditions of Article 36(1), point (b), continue to be met. Those verifications shall include audits, where appropriate. Where necessary in view of those verifications, it shall immediately complement, adjust or delete the data.

AddedArticle 43 – paragraph 1 – point 2 – point c: (c) giving providers of hosting services and providers of number-independent, interpersonal communications services that received a detection order access to the relevant databases of indicators in accordance with Article 46;

RemovedArticle 46 – paragraph 8: 8. The EU Centre shall ensure that the data contained in the databases referred to in Articles 44 and 45 is stored in a secure manner and that the storage is subject to appropriate technical and organisational safeguards that ensure an effective supervision, especially in automated processing systems. Those safeguards shall ensure, in particular, that the data can be accessed and processed only by duly authorised persons for the purpose for which the person is authorised and that a high level of security is achieved. The EU Centre shall regularly review those safeguards and adjust them where necessary. It shall maintain a record of processing activities as established in Article 30 of Regulation (EU) 2016/679 which, upon request, shall be made available to the EU Centre’s data protection officer and to the European Data Protection Supervisor.

AddedArticle 43 – paragraph 1 – point 4 – point d: (d) providing information assistance and support to victims in accordance with Articles 20 and 21;

RemovedArticle 47 – paragraph 1 – point b: (b) the processing of the submissions by Coordinating Authorities, the generation of the indicators, the compilation of the list of Uniform Resource Identifiers and the record-keeping, referred to in Article 44(3);

AddedArticle 43 – paragraph 1 – point 4 a (new): (4 a) conduct searches on publicly accesible content on hosting services for known child sexual abuse material in accordance with Article 49.1(ba);

RemovedArticle 48 – paragraph 1: 1. The EU Centre shall expeditiously and accurately assess and process reports submitted by providers of hosting services and providers of interpersonal communications services in accordance with Article 12 to determine whether the reports are manifestly unfounded or not. To that end, providers of hosting services and providers of interpersonal communications services shall make all the reasonable efforts to ensure the quality of the information submitted in accordance with Article 13, in order to facilitate an expeditious and accurate assessment and process.

AddedArticle 43 – paragraph 1 – point 6 – introductory part: (6) facilitate the generation and sharing of knowledge and best practices, with other Union institutions, bodies, offices and agencies, Coordinating Authorities or other relevant authorities of the Member States to contribute to the achievement of the objective of this Regulation, by:

RemovedArticle 48 – paragraph 7: 7. The time periods referred to in paragraph 6, points (a) and (b), shall be those specified in the competent law enforcement authority’s request to the EU Centre, provided that they remain limited to what is necessary to avoid interference with the activities for the prevention, detection, investigation, and prosecution of child sexual abuse offences and does not exceed 18 months.

AddedArticle 43 – paragraph 1 – point 6 – point a: (a) collecting, recording, analysing and providing information, providing analysis based on anonymised and non-personal data gathering, including gender-, sex- and age-disaggregated data in accordance with Article 51;

RemovedArticle 49 – paragraph 1 – introductory part: 1. The EU Centre shall have the power to conduct targeted searches on hosting services for the dissemination of publicly accessible child sexual abuse material, using the relevant indicators from the database of indicators referred to in Article 44(1), points (a) and (b), in the following situations:

AddedArticle 43 – paragraph 1 – point 6 – point a a (new): (a a) providing assistance, expertise and coordination on matters regarding the prevention and combating of online child sexual abuse in order to support them when taking measures or formulating courses of action within their respective spheres of competence;

RemovedArticle 49 – paragraph 3: 3. Where so requested by a competent law enforcement authority of a Member State in order to avoid interfering with activities for the prevention, detection, investigation and prosecution of child sexual abuse offences, the EU Centre shall not proceed according to paragraph 2, for as long as necessary to avoid such interference but no longer than 18 months.

AddedArticle 43 – paragraph 1 – point 6 – point a b (new): (a b) supporting the development of age-appropiate and gender-sensitive awareness-raising and prevention campaings, educational and intervention programs, tools and materials, taking with a specific focus on vulnerable groups, in order to enhance digital literacy among users and to equip children and adults, including parents and educators, with adequate skills for detecting potential malicious behaviour online and to contribute to ensure safe use of the internet by children.

RemovedArticle 50 – paragraph 1 – subparagraph 3: Before including specific technologies on those lists, the EU Centre shall request the opinion of its Technology Committee and, upon request of the Commission, the opinion of the European Data Protection Board. The Technology Committee and the European Data Protection Board shall deliver their respective opinions within eight weeks. That period may be extended by a further six weeks where necessary, taking into account the complexity of the subject matter. The Technology Committee and the European Data Protection Board shall inform the EU Centre of any such extension within one month of receipt of the request for consultation, together with the reasons for the delay. Where the EU Centre substantially deviates from those opinions, it shall inform the Technology Committee or the European Data Protection Board and the Commission thereof, specifying the points where it deviated and the main reasons for that deviation.

AddedArticle 43 – paragraph 1 – point 6 – point a c (new): (a c) facilitating the drafting of recommendations and guidelines for providers on prevention and mitigation of child sexual abuse, in particular in the digital space and taking into account technological developments.