EDRi's comments on the Data Protection Reform

(a) public security;
(b) the prevention, investigation, detection and prosecution of criminal offences;
(c) other public interests of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters and the protection of market stability and integrity;
(d) the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;
(e) a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (a), (b), (c) and (d);
(f) the protection of the data subject or the rights and freedoms of others.

2. In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to the objectives to be pursued by the processing and the determination of the controller.

(a) public security;
(b) the prevention, investigation, detection and prosecution of criminal offences;
(c) other important public interests of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters and the protection of market stability and integrity;
(d) the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;
(e) a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (a), (b), (c) and (d);
(f) the protection of the data subject or the rights and freedoms of others.

2. In particular, any legislative measure referred to in paragraph 1 must comply with the standards of necessity and proportionality and shall contain specific provisions at least as to:

(a) the objectives to be pursued by the processing;
(b) and the determination of the controller.;
(c) the specific purposes and means of processing;
(d) the categories of persons authorised to process the data;
(e) the procedure to be followed for the processing;
(f) the safeguards against any arbitrary interferences by public authorities;
(g) the right of data subjects to be informed about the restriction

3. Legislative measures referred to in paragraph 1 shall not impose obligations on private controllers to retain data additional to those strictly necessary for the original purpose.

4. Legislative measures referred to in paragraph 1 shall be notified to the European Data Protection Board for opinion. If the European Data Protection Board considers that the notified measure does not comply with the requirements of paragraph 2, it shall inform the Commission. The Commission shall then consider launching the procedure established under Article 258 of the Treaty on the Functioning of the European Union.