Changes from report parliamentary committee draft to plenary report

DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

▸5 unchanged paragraphs

on the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) 2021/1232 as regards the extension of its period of application

(COM(2025)0797 – C100370/2025 – 2025/0429(COD))

(Ordinary legislative procedure: first reading)

The European Parliament,

– having regard to the Commission proposal to Parliament and the Council (COM(2025)0797),

Changed– having regard to Article 294(2),294(2) and Article 16(2) and Art.Article 114(1),114(1) of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C100370/2025),

– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

– having regard to Rule 60 of its Rules of Procedure,

Changed– having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A100000/2026),(A10-0040/2026),

Change 1

Removed1. Adopts its position at first reading hereinafter set out;

Added1. Rejects the Commission proposal;

Change 2

Changed2. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amendwithdraw its proposal;

3. Instructs its President to forward its position to the Council, the Commission and the national parliaments.

Change 3

RemovedRecital 2: (2) The proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, which the Commission adopted on 11 May 2022 (‘the 2022 proposal¨), aims to provide the long-term legal framework. However, the interinstitutional negotiations on that proposal have not yet advanced sufficiently to be certain that they will be concluded on time for the long-term legal framework, including any amendments to Regulation (EU) 2021/1232 that it may contain, to be adopted and start to apply before 4 April 2026. The European Parliament adopted its position and the mandate to enter into inter-institutional negotiations on 22 November 2023 while the Council was unable to reach its position before 26 November 2025. This requires further extension, even though Regulation (EU) 2021/1232 was designed to be a temporary and unique instrument that allowed for sufficient time for the adoption for the 2022 proposal.

RemovedRecital 4: (4) Given these circumstances, Regulation (EU) 2021/1232 should be amended to extend its period of application for a period of time limited to that which is strictly necessary for the long-term legal framework to be adopted and start to apply. The co-legislators therefore commit to reaching an agreement on the long-term legal framework as soon as possible and with a view to avoiding any further extensions of Regulation (EU) 2021/1232 in the future. Furthermore, taking into consideration that Regulation (EU) 2021/1232 was intended to apply during a limited period of time, it is necessary to clarify some provisions thereof and adapt them to the results from the Implementing Reports from the Commission of 19 December 20231a and of 27 November 20251b (‘the 2023 and 2025 implementing reports’) . / 1a COM(2023)0797 / 1b COM(2025)0740

RemovedRecital 5 a (new): (5 a) The mere fact that certain providers of number-independent interpersonal communications services apply detection technologies on a voluntary basis does not relieve the co-legislators from their responsibility of establishing a comprehensive legal framework which meets the requirements of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’) and does not undermine the prohibition of general monitoring under Union law

RemovedRecital 5 b (new): (5 b) Nothing in this Regulation should be interpreted as prohibiting, weakening or undermining end-to-end encryption. Providers should in particular not be prohibited to offer end-to-end encrypted services.

RemovedRecital 7 a (new): (7 a) The processing of images and videos under Regulation (EU) 2021/1232 should always be considered to be processing of special categories of personal data under Article 9 of Regulation (EU) 2016/679 of the European Parliament and of the Council1a as they are biometric data that are processed through a specific technical means allowing the unique identification or authentication of a natural person. / 1a Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, ELI: http://data.europa.eu/eli/reg/2016/679/oj).

RemovedRecital 7 b (new): (7 b) In light of the 2023 and 2025 implementing reports to ensure consistency and clarity, definitions which are no longer relevant due to incomplete, inaccurate data that cannot be independently audited should be deleted from Regulation (EU) 2021/1232. Since the scope of Regulation (EU) 2021/1232 should not include detection of not previously identified online child sexual abuse material, or solicitation of children, their definitions are redundant and therefore should be deleted. The 2023 and 2025 implementing reports also stress that no conclusive data on the proportionality of detecting not previously identified online child sexual abuse material, or solicitation of children can be relied upon to justify the restriction of certain rights as provided by Directive 2002/58/EC and Articles 7 and 8 of the Charter.

RemovedRecital 7 c (new): (7 c) Considering the unproven effectiveness of Regulation (EU) 2021/1232 regarding not previously identified online child sexual abuse material, or solicitation of children, while at the same time the impact on the confidentiality of communications as provided by Directive 2002/58/EC of the European Parliament and of the Council1a, the detection of not previously identified child sexual abuse material and child solicitation should be taken out of the scope of Regulation (EU) 2021/1232. However, in order to prevent solicitation of children, certain providers of number-independent interpersonal communications services can and are encouraged to take mitigation measures, which do not interfere with Directive 2002/58/EC. / 1a Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), (OJ L 201, 31.7.2002, ELI: http://data.europa.eu/eli/dir/2002/58/oj).

RemovedRecital 7 d (new): (7 d) Since the sole objective of this Regulation is to enable the limited and targeted, modified continuation of certain existing activities aimed at combating child sexual abuse online, the derogation provided for by this Regulation should be limited to well-established technology that is used by certain providers of number- independent interpersonal communications services for the purpose of detecting, reporting and removing child sexual abuse material, which functions by matching images and videos against a database of unique, non-reconvertible digital signatures ((‘hashes’) of identified child sexual abuse material.

RemovedRecital 7 e (new): (7 e) In order to ensure an adequate level of transparency and accountability, as well as to enable comprehensive and comparable reporting, it is necessary to include administrative fines for non-compliance by certain providers of number- independent interpersonal communications services with the reporting and transparency obligations and requirements, notably the use of the standard form for report as established by Regulation (EU) 2024/1307 of the European Parliament and of the Council1a and subsequent Commission Implementing Regulation (EU) 2024/29161b. / 1a Regulation (EU) 2024/1307 of the European Parliament and of the Council of 29 April 2024 amending Regulation (EU) 2021/1232 on a temporary derogation from certain provisions of Directive 2002/58/EC as regards the use of technologies by providers of number-independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse (OJ L, 2024/1307, 14.5.2024, ELI: http://data.europa.eu/eli/reg/2024/1307/oj). / 1b Commission Implementing Regulation (EU) 2024/2916 of 25 November 2024 laying down a standard form for the data included in the report on the processing of personal data published and reported to the competent supervisory authority and to the Commission by service providers under Regulation (EU) 2021/1232 of the European Parliament and of the Council, (OJ L, 2024/2916, 26.11.2024, ELI: http://data.europa.eu/eli/reg_impl/2024/2916/oj).

RemovedRecital 7 f (new): (7 f) In order to strengthen the enforcement of the rules of Regulation (EU) 2021/1232, administrative fines should be imposed for any infringement of that Regulation, in addition to, or instead of appropriate measures imposed by the supervisory authority pursuant to that Regulation.

RemovedRegulation (EU) 2021/1232

RemovedArticle -1 (new), Recital 16: Article -1 / Recital 16 of Regulation (EU) 2021/1232 is replaced by the following: / ‘The types of technologies used for the purposes of this Regulation should be the least privacy-intrusive in accordance with the state of the art in the industry. Those technologies should not be used to systematically filter and scan text in communications unless it is solely to detect patterns which point to possible concrete reasons for suspecting online child sexual abuse, and they should not be able to deduce the substance of the content of the communications.’

RemovedRegulation (EU) 2021/1232

RemovedArticle -1 a (new), Recital 21: Article -1a / Recital 21 of Regulation (EU) 2021/1232 is replaced by the following: / ‘In order to ensure transparency and accountability in respect of the activities undertaken pursuant to the derogation provided for by this Regulation, providers should, by 3 February 2022, and by 31 January every year thereafter, publish and submit reports to the competent supervisory authority designated pursuant to Regulation (EU) 2016/679 (‘supervisory authority’) and to the Commission. Such reports should cover processing falling within the scope of this Regulation, including the type and volumes of data processed, the specific grounds relied on for the processing of personal data pursuant to Regulation (EU) 2016/679, the grounds relied on for transfers of personal data outside the Union pursuant to Chapter V of Regulation (EU) 2016/679, where applicable, the number of cases of online child sexual abuse identified, the number of cases in which a user has lodged a complaint with the internal redress mechanism or sought a judicial remedy and the outcome of such complaints and judicial proceedings, the numbers and ratios of errors (false positives) of the different technologies used, the measures applied to limit the error rate and the error rate achieved, the retention policy and the data protection safeguards applied pursuant to Regulation (EU) 2016/679, and the names of the organisations acting in the public interest against child sexual abuse with which data have been shared pursuant t…

RemovedRegulation (EU) 2021/1232

RemovedArticle -1 b (new), Article 2 – point 3: Article -1b / In Article 2 of Regulation (EU) 2021/1232, point 3 is deleted.

RemovedRegulation (EU) 2021/1232

RemovedArticle -1 c (new), Article 2 – point 4: Article -1c / In Article 2 of Regulation (EU) 2021/1232, point 4 is deleted.

RemovedRegulation (EU) 2021/1232

RemovedArticle -1 d (new), Article 3 – paragraph 1: Article -1d / In Article 3 of Regulation (EU) 2021/1232, paragraph 1 is replaced by the following: / ‘1. Articles 5(1) and 6(1) of Directive 2002/58/EC shall not apply to the confidentiality of communications involving the processing by providers of personal data in connection with the provision of number-independent interpersonal communications services provided that: (a) the processing is: (i) strictly necessary for the use of specific technology for the sole purpose of detecting and removing known online child sexual abuse material and reporting it to law enforcement authorities and to organisations acting in the public interest against child sexual abuse; (ii) proportionate and limited to technologies used by providers for the purpose set out in point (i); (iii) limited to content data that are strictly necessary for the purpose set out in point (i); (iv) limited to what is strictly necessary for the purpose set out in point (i); (b) the technologies used for the purpose set out in point (a)(i) of this paragraph are in accordance with the state of the art in the industry and are the least privacy-intrusive, including with regard to the principle of data protection by design and by default laid down in Article 25 of Regulation (EU) 2016/679 and, to the extent that they are used to detect possible known online child sexual abuse material; (c) in respect of any specific technology used for the purpose set out in point (a)(i) of this paragraph, a prior data protection impact …

RemovedRegulation (EU) 2021/1232

RemovedArticle -1 e (new), Article 9 – paragraph 1: Article -1e / In Article 9 of Regulation (EU) 2021/1232, paragraph 1 is replaced by the following: / ‘1. On the basis of the reports submitted pursuant to Article 3(1), point (g)(vii), and the statistics provided pursuant to Article 8, the Commission shall, by 4 September 2026, prepare a report on the implementation of this Regulation and submit and present it to the European Parliament and to the Council’.

RemovedRegulation (EU) 2021/1232

RemovedArticle -1 f (new), Article 7 a (new): Article -1f / The following article is inserted: / ‘Article 7a / General conditions for imposing administrative fines / The Commission shall impose fines for the infringement or failure to comply with this Regulation which shall in each individual case be effective, proportionate and dissuasive. / Infringements of this Regulation shall be subject to administrative fines up to 10,000,000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher. / The exercise by the Commission of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process.’

RemovedRegulation (EU) 2021/1232

RemovedArticle 1 – paragraph 1, Article 10 – paragraph 2: It shall apply until 3 April 2027.