Updated 11.01.2019 […] means that there will be no text in this line - 'DS' means drafting session with EP and COM - 'TM' means technical meeting with EP and COM Amended Commission EP Council negotiation mandate proposal amendments (ST 11312/18) Compromise text proposals (ST 10178/18) with the European Data Protection Supervisor as referred to in Article 50. 107 47a Article Penalties 553. Article 45a Penalties 554. Member States shall ensure that any misuse of data, processing of data or exchange of data contrary to this Regulation is punishable in accordance with national law. The penalties provided shall be effective, proportionate and dissuasive and shall include the possibility for administrative and criminal penalties. Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive. Provisionally agreed - outcome of trilogue 13/12 Member States shall ensure that any misuse of data, processing of data or exchange of data contrary to this Regulation is punishable in accordance with national law. The penalties provided shall be effective, proportionate and dissuasive. 555. Article 45b Liability Article 47b Liability Article 45b Liability 556. 1. Without prejudice to the right to compensation from, and liability of, the controller or processor under Regulations 1. Without prejudice to the right to compensation from, and liability of the controller or processor under Regulation Provisionally agreed - outcome of trilogue 13/12 1. Without prejudice to the right to compensation from, and 107 Articles Article 45a Penalties 47a and 47b are copied from the text agreed with the EP on the ETIAS Regulation. 245

Updated 11.01.2019 […] means that there will be no text in this line - 'DS' means drafting session with EP and COM - 'TM' means technical meeting with EP and COM Amended Commission EP Council negotiation mandate proposal amendments (ST 11312/18) Compromise text proposals (ST 10178/18) (EC) No 45/2001 and (EU) 2016/679 and Directive (EU) 2016/680: (EU) 2016/679, Directive (EU) 2016/680 and [Regulation XX/2018 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC]: liability of the controller or processor under Regulation (EU) 2016/679, Directive (EU) 2016/680 and Regulation 2018/1725: 557. (a) any person or Member State that has suffered material or non-material damage as a result of an unlawful personal data processing operation or any other act incompatible with this Regulation by a Member State shall be entitled to receive compensation from that Member State; and (a) any person or Member State that has suffered material or non-material damage as a result of an unlawful personal data processing operation or any other act incompatible with this Regulation by a Member State shall be entitled to receive compensation from that Member State; Provisionally agreed - outcome of trilogue 13/12 (a) any person or Member State that has suffered material or non-material damage as a result of an unlawful personal data processing operation or any other act incompatible with this Regulation by a Member State shall be entitled to receive compensation from that Member State; 558. (b) any person or Member State that has suffered material or (b) any person or Member State that has suffered material Provisionally agreed - outcome 246

Updated 11.01.2019 […] means that there will be no text in this line - 'DS' means drafting session with EP and COM - 'TM' means technical meeting with EP and COM Amended Commission EP Council negotiation mandate proposal amendments (ST 11312/18) Compromise text proposals (ST 10178/18) non-material damage as a result of any act by Europol, the European Border and Coast Guard Agency or eu-LISA incompatible with this Regulation shall be entitled to receive compensation from the agency in question. or non-material damage as a result of any act by eu-LISA incompatible with this Regulation shall be entitled to receive compensation from that agency. eu-LISA shall be liable for unlawful personal data processing operations in accordance with its role as processor. of trilogue 13/12 (b) any person or Member State that has suffered material or non-material damage as a result of any act by Europol, the European Border and Coast Guard Agency or eu-LISA incompatible with this Regulation shall be entitled to receive compensation from the agency in question. 559. The Member State concerned, Europol, the European Border and Coast Guard Agency or eu- LISA shall be exempted from their liability under the first subparagraph, in whole or in part, if they prove that they are not responsible for the event which gave rise to the damage. That Member State or eu-LISA shall be exempted from their liability, in whole or in part, if they prove that they are not responsible for the event which gave rise to the damage. Provisionally agreed - outcome of trilogue 13/12 The Member State concerned, Europol, the European Border and Coast Guard Agency or eu- LISA shall be exempted from their liability under the first subparagraph, in whole or in part, if they prove that they are not responsible for the event which gave rise to the damage. 560. 2. If any failure of a Member State to comply with its obligations under this Regulation causes damage to the 2. If any failure of a Member State to comply with its obligations under this Regulation causes damage to the Provisionally agreed - outcome of trilogue 13/12 2. If any failure of a Member State to comply with its 247

Updated 11.01.2019 […] means that there will be no text in this line - 'DS' means drafting session with EP and COM - 'TM' means technical meeting with EP and COM Amended Commission EP Council negotiation mandate proposal amendments (ST 11312/18) interoperability components, that Member State shall be liable for such damage, unless and insofar as eu-LISA or another Member State bound by this Regulation failed to take reasonable measures to prevent the damage from occurring or to minimise its impact. interoperability components, that Member State shall be held liable for such damage, unless and insofar as eu-LISA or another Member State participating in the interoperability components failed to take reasonable measures to prevent the damage from occurring or to minimise its impact. obligations under this Regulation causes damage to the interoperability components, that Member State shall be liable for such damage, unless and insofar as eu-LISA or another Member State bound by this Regulation failed to take reasonable measures to prevent the damage from occurring or to minimise its impact. 3. Claims for compensation against a Member State for the damage referred to in paragraphs 1 and 2 shall be governed by the national law of the defendant Member State. Claims for compensation against the controller or eu-LISA for the damage referred to in paragraphs 1 and 2 shall be subject to the conditions provided for in the Treaties. 3. Claims for compensation against a Member State for the damage referred to in paragraphs 1 and 2 shall be governed by the national law of the defendant Member State. Claims for compensation against the controller or eu- LISA for the damage referred to in paragraphs 1 and 2 shall be subject to the conditions provided for in the Treaties. Provisionally agreed - outcome of trilogue 13/12 3. Claims for compensation against a Member State for the damage referred to in paragraphs 1 and 2 shall be governed by the national law of the defendant Member State. Claims for compensation against the controller or eu- LISA for the damage referred to in paragraphs 1 and 2 shall be subject to the conditions provided for in the Treaties. Compromise text proposals (ST 10178/18) 561. 248

Updated 11.01.2019 […] means that there will be no text in this line - 'DS' means drafting session with EP and COM - 'TM' means technical meeting with EP and COM Amended Commission EP Council negotiation mandate proposal amendments (ST 11312/18) Article 46 Right of to information Article 46 Right of information Compromise text proposals (ST 10178/18) 562. Article 46 Right of information Provisionally agreed Article 46 Right of to information 563. 1. Without prejudice to the right of information referred to in Articles 11 and 12 of Regulation (EC) 45/2001 and Articles 13 and 14 of Regulation (EU) 2016/679, persons whose data are stored in the shared biometric matching service, the common identity repository or the multiple-identity detector shall be informed by the authority collecting their data, at the time their data are collected, about the processing of personal data for the purposes of this Regulation, including about identity and contact details of the respective data controllers, and about the procedures for exercising their rights of access, rectification and erasure, as well as about the contact details of the European Data Protection Supervisor and of the national 1. Without prejudice to the 1. Without prejudice to the right of information referred to in right of information referred to in Articles 11 and 12 of Regulation Articles 11 and 12 of Regulation (EC) 45/2001 [or Articles 15 and (EC) 45/2001 and Articles 13 and 16 of Regulation XX/2018 of the 14 of Regulation (EU) 2016/679, European Parliament and of the The authority collecting the data Council on the protection of of persons whose data are stored individuals with regard to the in the shared biometric matching processing of personal data by service BMS, the common the Union institutions, bodies, identity repository CIR or the offices and agencies and on the multiple-identity detector MID free movement of such data, and shall be informed by provide repealing Regulation (EC) No those persons with the 45/2001 and Decision No information required under 1247/2002/EC], Articles 13 and Articles 11 and 12 of Regulation, 14 of Directive (EU) 2016/680 (EC) 45/2001 and Articles 13 and Articles 13 and 14 of and 14 of Regulation (EU) Regulation (EU) 2016/679, 2016/679 in the manner required persons whose data are stored in by Article 12 and Article 13 of the shared biometric matching Directive 2016/680. The service BMS, the common authority collecting their data, identity repository CIR or the shall provide the information at multiple-identity detector MID the time their that such data are To be tested with MS (DS 26/11) 1. Without prejudice to the right of information referred to in Articles 11 and 12 of Regulation (EC) 45/2001 and Articles 13 and 14 of Regulation (EU) 2016/679, The authority collecting the data of persons whose data are stored in the shared biometric matching service BMS, the common identity repository CIR or the multiple-identity detector MID shall be informed by provide those persons with the information required under Articles 11 and 12 of Regulation (EC) 45/2001 and Articles 13 and 14 of Regulation (EU) 2016/679 in the manner required and Article 12 and Article 13 of Directive 2016/680. The authority collecting their 249

Updated 11.01.2019 […] means that there will be no text in this line - 'DS' means drafting session with EP and COM - 'TM' means technical meeting with EP and COM Amended Commission EP Council negotiation mandate proposal amendments (ST 11312/18) collected , about the processing of personal data for the purposes of this Regulation, including about identity and contact details of the respective data controllers, and about the procedures for exercising their rights of access, rectification and erasure, as well as about the contact details of the European Data Protection Supervisor and of the national supervisory authority of the Member State responsible for the collection of the data. shall be informed by the authority collecting their data data controller, at the time their data are collected in accordance with paragraph 2, about the processing of personal data for the purposes of this Regulation, including about identity and contact details of the respective data controllers, about the period for which the personal data will be stored or about the criteria used to determine that period, and about the procedures for exercising their rights of access, rectification and erasure, as well as about the contact details of the European Data Protection Supervisor and of the national supervisory authority of the Member State responsible for the collection of the data. Compromise text proposals (ST 10178/18) supervisory authority of the Member State responsible for the collection of the data. 564. 1a. All information shall be provided to data subjects in a manner and language which they understand, or are reasonably expected to understand. This shall include data, shall provide the information at the time their that such data are collected , about the processing of personal data for the purposes of this Regulation, including about identity and contact details of the respective data controllers, and about the procedures for exercising their rights of access, rectification and erasure, as well as about the contact details of the European Data Protection Supervisor and of the national supervisory authority of the Member State responsible for the collection of the data. To be tested with MS (DS 26/11) 1a. All information shall be made available, using clear and plain language, in a linguistic version the person concerned 250

Updated 11.01.2019 […] means that there will be no text in this line - 'DS' means drafting session with EP and COM - 'TM' means technical meeting with EP and COM Amended Commission EP Council negotiation mandate proposal amendments (ST 11312/18) Compromise text proposals (ST 10178/18) providing information in a manner which is appropriate to the age of the data subjects who are minors. understands or is reasonably expected to understand. This shall include providing information in a manner which is appropriate to the age of the data subjects who are minors. 2. Persons whose data is recorded in the EES, the VIS or [the ETIAS] shall be informed about the processing of data for the purposes of this Regulation in accordance with paragraph 1 when: 2. Persons whose data is recorded in the EES, the VIS or [the ETIAS] shall be informed about the processing of data for the purposes of this Regulation in accordance with paragraph 1 when: 2. Persons whose data is are recorded in the EES, the VIS or [the ETIAS] shall be informed about the processing of personal data for the purposes of this Regulation in accordance with paragraph 1 when: Provisionally agreed 2. Persons whose data is are recorded in the EES, the VIS or [the ETIAS] shall be informed about the processing of personal data for the purposes of this Regulation in accordance with paragraph 1 when: [an individual file is 566. (a) created or updated in the EES in accordance with Article 14 of the EES Regulation]; (a) [an individual file is created or updated in the EES in accordance with Article 14 of the EES Regulation]; (a) [an individual file is created or updated in the EES in accordance with Article 14 of the EES Regulation (EU) 2017/2226]; Provisionally agreed (a) [an individual file is created or updated in the EES in accordance with Article 14 of the EES Regulation (EU) 2017/2226]; (b) an application file is created or updated in the VIS in accordance with Article 8 of Regulation (EC) No 767/2008; (b) an application file is created or updated in the VIS in accordance with Article 8 of Regulation (EC) No 767/2008; Provisionally agreed (b) an application file is created or updated in the VIS in accordance with Article 8 of Regulation (EC) No 767/2008; 565. 567. (b) an application file is created or updated in the VIS in accordance with Article 8 of Regulation (EC) No 767/2008; 251

Updated 11.01.2019 […] means that there will be no text in this line - 'DS' means drafting session with EP and COM - 'TM' means technical meeting with EP and COM Amended Commission EP Council negotiation mandate proposal amendments (ST 11312/18) Compromise text proposals (ST 10178/18) 568. (c) [an application file is created or updated in the ETIAS in accordance with Article 17 of the ETIAS Regulation;] (c) [an application file is created or updated in the ETIAS in accordance with Article 17 of the ETIAS Regulation;] (c) [an application file is created or updated in the ETIAS in accordance with Article 19 17 of the ETIAS Regulation;]. Provisionally agreed (c) [an application file is created or updated in the ETIAS in accordance with Article 19 17 of the ETIAS Regulation;]. 569. (d) – (not applicable); (d) – (not applicable); (d) – (not applicable); Provisionally agreed […] 570. (e) – (not applicable). (e) – (not applicable). (e) – (not applicable). Provisionally agreed […] 571. 572. Article 46a Information Campaign The Commission shall, in cooperation with the supervisory authorities and the European Data Protection Supervisor, accompany the start of operations of each interoperability component with an information campaign informing the public and, in particular, third-country nationals, about the objectives and the functioning of those Provisionally agreed - outcome of trilogue 13/12 […] Provisionally agreed - outcome of trilogue 13/12 […] 252

Updated 11.01.2019 […] means that there will be no text in this line - 'DS' means drafting session with EP and COM - 'TM' means technical meeting with EP and COM Amended Commission EP Council negotiation mandate proposal amendments (ST 11312/18) Compromise text proposals (ST 10178/18) components, the authorities having access and the conditions for such access, and the rights of persons concerned. Such information campaigns shall be conducted continuously. 573. Article 47 Right of access, correction and erasure Article 47 Right of access to, rectification, completion, correction and erasure of personal data, and of restriction of the processing thereof - web service Article 47 Right of access, correction rectification and erasure of data stored in the MID Outcome DS 8/1 (OK for MS) Article 47 Right of access to, correction rectification, and erasure of personal data stored in the MID and restriction of processing thereof 574. 1. In order to exercise their rights under Articles 13, 14, 15 and 16 of Regulation (EC) 45/2001 and Articles 15, 16, 17 and 18 of Regulation (EU) 2016/679, any person shall have the right to address him or herself to the Member State responsible for the manual verification of different identities or of any Member State, who shall examine and reply to the request. 1. In order to exercise their rights under Articles 13, 14, 15 and 16 of Regulation(EC) 45/2001 and Articles 15, 16, 17 and 18 of Regulation (EU) 2016/679 and Articles 14 and 16 of Directive (EU)2016/680 as regards the processing of personal data in the CIR, the shared BMS and the MID, any person shall have the right to address him or herself to the Member State responsible for the manual verification of different 1. In order to exercise their rights under Articles 13, 14, 15 and 16 of Regulation (EC) 45/2001 [or Articles 17, 18, 19 and 20 of Regulation XX/2018 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No Outcome DS 8/1 1. In order to exercise their rights under Articles 13, 14, 15 and 16 of Regulation (EC) 45/2001 or Articles 17, 18, 19 and 20 of Regulation 2018/1725 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, 253

Updated 11.01.2019 […] means that there will be no text in this line - 'DS' means drafting session with EP and COM - 'TM' means technical meeting with EP and COM Amended Commission EP Council negotiation mandate proposal amendments (ST 11312/18) Compromise text proposals (ST 10178/18) 575. identities or of any to any other 1247/2002/EC], Article 16 of Member State, who shall examine Directive (EU) 2016/680 and Articles 15, 16, 17 and 18 of and reply to the request. Regulation (EU) 2016/679, any person shall have the right to address him or herself to the Member State responsible for the manual verification of different identities or competent authority of any Member State, who shall examine and reply to the request. and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, Articles 14, 15and 16 of Directive (EU) 2016/680 and Articles 15, 16, 17 and 18 of Regulation (EU) 2016/679, any person shall have the right to address him or herself to the Member State responsible for the manual verification of different identities or competent authority of any Member State, who shall examine and reply to the request. 1a. Without prejudice to paragraph 1, and in order to facilitate and better enable the effective exercise of the rights of data subjects as described in paragraph 1 to access, rectify, erase or restrict the processing of their personal data under interoperability components, in particular for those third- country nationals who may be outside the territory of the Member States, eu-LISA shall Provisionally agreed - outcome of trilogue 13/12 […] 254