Commission Delegated Regulation (EU) 2018/1239Show full title

Commission Delegated Regulation (EU) 2018/1239

of 9 July 2018

amending Annex III to Regulation (EU) No 211/2011 of the European Parliament and of the Council on the citizens’ initiative

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 211/2011 of the European Parliament and of the Council of 16 February 2011 on the citizens’ initiative(1) and in particular Article 16 thereof,

Whereas:

(1) Article 5(1) of Regulation (EU) No 211/2011 provides that organisers of citizens’ initiatives are to use only forms which comply with the models set out in Annex III to that Regulation for collecting statements of support from signatories.

(2) The statement of support forms contain a privacy statement providing information on how signatories’ personal data may be processed and what are the rights of signatories as data subjects. The privacy statement refers to the repealed Directive 95/46/EC of the European Parliament and of the Council(2).

(3) Directive 95/46/EC was repealed by Regulation (EU) 2016/679(3). Regulation (EU) 2016/679 started to apply from 25 May 2018.

(4) Article 13 of Regulation (EU) 2016/679 sets out the information which needs to be provided, at the time when personal data are obtained, by the data controller to the data subject where personal data are collected from the data subject. Such information should be provided henceforth in the privacy statement of the statement of support form model.

(5) According to Article 94 of Regulation (EU) 2016/679, references to the repealed Directive 95/46/EC are to be construed as references to Regulation (EU) 2016/679. For reasons of clarity, legal certainty and transparency, the reference in the privacy statement should be updated.

(6) Annex III to Regulation (EU) No 211/2011 should therefore be amended accordingly.

(7) The European Data Protection Supervisor was consulted in accordance with Article 28(2) of Regulation (EC) No 45/2001 of the European Parliament and of the Council(4),

HAS ADOPTED THIS REGULATION:

Article 1 U.K.

Annex III to Regulation (EU) No 211/2011 is amended as follows:

(1)

the text of the privacy statement set out in the model for statement of support form at the end of part A is replaced by the following:

‘Privacy statement: In accordance with the General Data Protection Regulation, your personal data provided on this form will only be used for the support of the initiative and made available to the competent national authorities for the purpose of verification and certification. You are entitled to request from the organisers of this initiative access to, rectification of, erasure and restriction of processing of your personal data.

Your data will be stored by the organisers for a maximum retention period of 18 months after the date of registration of the proposed citizens’ initiative, or one month after submitting that initiative to the Commission, whichever is the earlier. It might be retained beyond these time limits in the case of administrative or legal proceedings, for a maximum of one week after the date of conclusion of these proceedings.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge at any time a complaint with a data protection authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that your data is unlawfully processed.

The organisers of the citizens’ initiative are the controllers in the meaning of the General Data Protection Regulation and they can be contacted using the details provided on this form.

The contact details of the data protection officer (if any) are available at the web address of this initiative in the European Commission’s register, as provided on this form.

The contact details of the national authority which will receive and process your personal data and the contact details of the national data protection authorities can be consulted at: http://ec.europa.eu/citizens-initiative/public/data-protection.’;

(2)

the text of the privacy statement set out in the model for statement of support form at the end of part B is replaced by the following:

‘Privacy statement: In accordance with the General Data Protection Regulation, your personal data provided on this form will only be used for the support of the initiative and made available to the competent national authorities for the purpose of verification and certification. You are entitled to request from the organisers of this initiative access to, rectification of, erasure and restriction of processing of your personal data.

Your data will be stored by the organisers for a maximum retention period of 18 months after the date of registration of the proposed citizens’ initiative, or one month after submitting that initiative to the Commission, whichever is the earlier. It might be retained beyond these time limits in the case of administrative or legal proceedings, for a maximum of one week after the date of conclusion of these proceedings.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge at any time a complaint with a data protection authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that your data is unlawfully processed.

The organisers of the citizens’ initiative are the controllers in the meaning of the General Data Protection Regulation and they can be contacted using the details provided on this form.

The contact details of the data protection officer (if any) are available at the web address of this initiative in the European Commission’s register, as provided on this form.

The contact details of the national authority which will receive and process your personal data and the contact details of the national data protection authorities can be consulted at: http://ec.europa.eu/citizens-initiative/public/data-protection.’.

Article 2 U.K.

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 9 July 2018.

For the Commission

The President

Jean-Claude Juncker

(1)

OJ L 65, 11.3.2011, p. 1.

(2)

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).

(3)

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

(4)

Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).