On 18 December 2015, under the Luxembourg Presidency and subject to the European Parliament and Council formal vote, the Coreper (Permanent Representatives Committee) approved a final package on plant health.
The Council and European Parliament representatives finalised the overall compromise during a trilogue meeting held on 16 December.
The proposal on protective measures against pests of plants aims to address increased risks in that area, which stem from the emergence of new pests and diseases. It will also modernise instruments related to intra-EU trade or trade with third countries focusing on a risk-based approach. Better surveillance and early eradication of outbreaks of new pests are the tools which should be used to ensure plant health.
Together with the regulation on animal health (which should be adopted soon) and the proposal on official controls (currently under examination in the Council), the draft regulation on plant health aims to strengthen the enforcement of health and safety standards for the whole agri-food chain.
The next stepsThe European Parliament is expected to vote on the compromise text at a meeting of its Committee on Agriculture and Rural Development in late February.
The Chairman of the European Parliament's Committee on Agriculture and Rural Development will send a letter to the Chairman of Coreper. The letter will indicate that if the Council adopts at first reading the compromise text as adopted by the European Parliament's Committee on Agriculture and Rural Development (after legal-linguistic revision), the Parliament plenary will adopt the same text at its second reading, without any amendment, and the legislative procedure will be concluded.
This should enable the entry into force of the new plant health regulation by the end of 2016 and its application after a three-year period following the entry into force, during which the relevant pieces of secondary legislation will be adopted.
This morning, we had a serious political discussion about completing the Economic and Monetary Union. The European Central Bank President Mario Draghi also joined us and has stressed the need for progress. We have one clear message from our debate: there is no time for complacency in reforming the eurozone. We stand ready to take difficult decisions on banking union and economic governance in the coming year. Our ministers will work rapidly and report to us next June.
We congratulated President Hollande on the historic success of COP21 in Paris and assessed progress on building the Energy Union. We discussed the conditions that need to be met by major energy infrastructure projects. What we have agreed is that any new infrastructure should be fully in line with Energy Union objectives, such as reduction of energy dependency and diversification of suppliers, sources and routes. Not to mention the obvious obligation that all projects have to comply with all EU laws, including the third Energy Package. This is a clear condition for receiving support from the EU institutions or any Member State - be it political, legal or financial.
I cannot finish without a word of appreciation for Prime Minister Bettel and his team. Xavier, I think I can speak for all leaders when I say that the Luxembourg Presidency was outstanding with very hard work done on the migration crisis, Passanger Name Record and data protection. It was an extremely efficient presidency. Thank you, Xavier, and most sincere congratulations.
On 18 December 2015, the Permanent Representatives Committee (Coreper) endorsed an informal deal struck with the European Parliament on the first rules to strengthen the security of network and information systems across the EU.
The network and information security (NIS) directive will increase cooperation between member states and lay down security obligations for operators of essential services and digital service providers. Essential services operators are active in critical sectors such as energy, transport, health and finance. Digital services cover online marketplaces, search engines and cloud services.
The requirements will be stronger for essential operators than for digital service providers. This reflects the degree of risk that any disruption to their services may pose to society and the economy.
Each EU country will also be required to designate one or more national authorities and set out a strategy to deal with cyber threats.
What next?Once the agreed text has undergone technical finalisation, it needs to be formally approved first by the Council and then by the Parliament. The procedure is expected to be concluded in spring 2016.
After the directive has entered into force, member states will have 21 months to adopt the necessary national provisions. Following this period, they will have another 6 months to identify the essential services operators established in their territory which are to be covered by the directive.
The Paris COP21 climate conference was interesting in that it managed to produce a deal which was considered as historic to some and yet disappointing to others.
The latter will argue that the following make for a weak deal. The agreement does not make INDCs binding, the aggregated INDCs put the world on track to over 3°C temperature increase, and there isn’t nearly enough money in the pot to compensate poor countries or help them mitigate the effects of global warming.
Why is it considered historic then?
Because the risk for Paris was not so much to fail on climate as it was to fail on diplomacy. No one actually expected COP21 to result in a globally binding deal where country pledges would limit global warming to 2°C. Ironically, accepting this in the first place is why the conference was a success; any attempt to force such commitments on the Parties would have resulted in a Copenhagen 2.0. COP21 was a twelve-day fine-tuning session where all Parties already knew which lines could be crossed and which ones couldn’t.
Where politicians could not fail however was on the direction, on the vision that would come out of Paris. And when 195 countries manage to sit down and commit to pursuing their efforts to limit global warming to 1.5°C, you know something big happened that Saturday 12 December in Paris.
Although some consider it disappointing, the COP21 agreement’s impact on legislation should not be underestimated as its overall direction will give legitimacy for the institutions to push for more ambitious climate and energy policies. Green activists in Brussels will hold the 31-page agreement over policymakers’ heads to make sure whatever comes out of the Berlaymont is in line with what came out of Le Bourget. The long-term view to limiting global warming to 1.5°C immediately raised the question in Brussels of knowing if the EU needed to reconsider and raise the ambition of its targets for 2030, even before they had a chance of being translated into legislation.
While Commissioner Cañete’s latest declarations indicate that the Commission does not intend to push for raising the EU’s 40% GHG emission reduction target before the next Commission takes office, his successors will be under pressure to adjust the 2030 target upwards in order to reach full decarbonisation by the end of the century. The argument is likely to be used by the Commission however to try and raise the energy efficiency target from 27% to 30% for 2030, something it has clearly indicated it intended to do. Paris just gave it a reason. The European Parliament gathered this week in Strasbourg for the last Plenary of the year went even further, adopting a resolution calling for a binding and 40% energy efficiency target.
Expect a number of conferences on ‘COP21: Challenges and Opportunities’ to be held in the upcoming months. Paris gave the ‘long-term investment signal’ one part of industry was waiting for. The fact that other commentators actually had to reaffirm that ‘industry can be/is part of the solution’ is interesting in itself. It’s almost like there are those who believe we can do this without industry. In reality, as a delegate from Mali reminded me at COP21, “industry is the solution!” The only thing left for it to do is let the others know.
On 18 December 2015, the Permanent Representatives Committee (Coreper) confirmed the compromise texts agreed with the European Parliament on data protection reform. The agreement was reached between the Council, Parliament and Commission on the 15 December. This agreement is in line with the request from the European Council for negotiations on data protection reform to be concluded by the end of 2015.
Félix BRAZ, Luxembourg Minister of Justice and President of the Council said: "It is a fundamental agreement with important consequences. This reform not only strengthens the rights of citizens, but also adapts the rules to the digital age for companies, whilst reducing the administrative burden. These are ambitious and forward-looking texts. We can have full confidence in the result."
Data protection reform is a legislative package proposed by the Commission in 2012 to update and modernise the data protection rules. It concerns two legislative instruments: the general data protection regulation (intended to replace directive 95/46/EC) and the data protection directive in the area of law enforcement (intended to replace the 2008 data protection framework decision).
The protection of persons in relation to the processing of their personal data is a fundamental right laid down in the Charter of Fundamental Rights of the EU (Article 8) and in the Treaty on the Functioning of the European Union (Article 16).
The general data protection regulation aims at enhancing the level of data protection for individuals whose personal data is processed and increasing business opportunities in the digital single market including through reduced administrative burden.
An enhanced level of data protectionThe principles and rules on the processing of personal data of individuals must respect fundamental rights and freedoms, notably the right to protection of personal data. These strengthened data protection rights give data subjects (the individuals whose personal data is being processed) more control over their personal data:
To ensure proximity of legal redress, data subjects have the right for a decision of their data protection authority to be reviewed by their national court, irrespective of the member state in which the data controller is established.
Increased business opportunities in the digital single marketThe regulation provides for a single set of rules, valid across the EU and applicable both to European and non European companies offering on-line services in the EU. This avoids a situation where conflicting national data protection rules might disrupt the cross-border exchange of data. It also provides for increased cooperation between member states to ensure coherent application of the data protection rules across the EU. This will create fair competition and will encourage companies, especially small and medium-sized enterprises, to get the most out of the digital single market.
To reduce costs and provide legal certainty, in important cross-border cases where several national supervisory authorities are involved, a single supervisory decision is taken. This one-stop-shop mechanism allows a company which is active in several member states to deal only with the data protection authority in the member state of its main establishment. This mechanism also provides for a single decision applicable to the entire EU territory in case of disputes.
With a view to reducing administrative costs, the regulation applies a risk-based approach: data controllers can implement measures according to the risk involved in the data processing operations they perform. Different businesses have different activities and the risks of such activities in terms of privacy can vary. The regulation provides for no one-size-fits all solution: the stronger the risks of the activities for the personal data, the more stringent the obligations.
More and better tools to enforce compliance with the data protection rulesThe regulation provides a range of measures to increase the responsibility and accountability of data controllers in order to ensure full compliance with the new data protection rules. Data controllers must implement a number of security measures, including the requirement in certain cases to notify personal data breaches. To future-proof the regulation, the principles of data protection by design and by default are introduced. Public authorities and those companies that perform certain risky data processing must designate a data protection officer to ensure compliance with the rules.
Data subjects, and in certain conditions, data protection organisations can lodge a complaint with a supervisory authority or seek judicial remedy in case the data protection rules are not complied with. Data controllers can face maximum fines of up to €20 million or 4% of their global annual turnover.
Guarantees on the transfer of personal data outside the EUThe regulation lays down the rules for transferring personal data to third countries and international organisations. Transfers may take place provided that a number of conditions and safeguards are met, in particular where the Commission has decided that an adequate level of protection exists. New adequacy decisions will have to be reviewed at least every 4 years. Existing adequacy decisions and authorisations remain in force until amended, replaced or repealed.
Data protection directive in the field of law enforcementThis directive is aimed at protecting personal data processed for prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
It is crucial to ensure a consistent and high level of protection of personal data of individuals while at the same time facilitating the exchange of personal data between law enforcement authorities in the different member states.
Broader scope of applicationIn addition to covering activities aimed at preventing, investigating, detecting and prosecuting criminal offences the new directive has been extended to cover the safeguarding and prevention of threats to public security.
The new directive would apply to both the cross-border processing of personal data as well as the processing of personal data by the police and judicial authorities at purely national level. The framework decision, which will be replaced, covered only cross-border exchange of data.
Data subject's rightsThe rules strike a balance between the right to privacy and the need for the police not to reveal that data is being processed at an early stage of an investigation. However, the text lists the information that the data subject is always entitled to receive in order to protect his or her right if they fear that an infringement of their data has taken place.
The new rules will also cover the transfer of personal data to third countries and international organisations.
ComplianceThe new directive foresees that a data protection officer is appointed to help the competent authorities to ensure compliance with the data protection rules.
Another tool to ensure compliance is impact assessment. Where a type of processing is likely to result in a high risk for the rights and freedoms of individuals the competent authorities must carry out an assessment of the potential impact of a certain processing, in particular when using new technology.
Monitoring and compensationThe text of the directive is aligned with the text of the regulation in order to ensure that in broad terms the same general principles apply. In addition, the rules on the supervisory authority are to a large extent similar because the supervisory authority established in the general data protection regulation can also deal with matters falling under the directive. The new directive would also grant data subjects the right to receive compensation if they have suffered damage as a consequence of a processing that has not respected the rules.
NEXT STEPSOn 17 December, in an extra-ordinary meeting, the European Parliament's Civil Liberties, Justice and Home Affairs (LIBE) Committee endorsed the texts agreed in the trilogues. This support enabled Coreper today to confirm the final compromise texts on the regulation and the directive. After a legal-linguistic review of the texts, they will be submitted for adoption by the Council and, subsequently, by the Parliament. The regulation and the directive are likely to enter into force in spring 2018.