REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

EVROPSKÝ PARLAMENT A RADA EVROPSKÉ UNIE,
s ohledem na Smlouvu o fungování Evropské unie, a zejména na článek 16 této smlouvy,
s ohledem na návrh Evropské komise,
po postoupení návrhu legislativního aktu vnitrostátním parlamentům,
s ohledem na stanovisko Evropského hospodářského a sociálního výboru ('),
s ohledem na stanovisko Výboru regionů (2),
v souladu s řádným legislativním postupem (3),
vzhledem k těmto důvodům:

REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

(Text with EEA relevance)

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the proposal from the European Commission,

after forwarding the draft legislative act to the national parliaments,

Having regard to the opinion of the European Economic and Social Committee (),

Having regard to the opinion of the Committee of the Regions (),

In accordance with the ordinary legislative procedure (),

Whereas:

(1) The protection of natural persons with regard to the processing of personal data is a fundamental right. The provisions of Article 8 para. 1 of the Charter of Fundamental Rights of the European Union ('the Charter') and Article 16 para. Article 10(1) of the Treaty on the Functioning of the European Union (TFEU) recognises the right to the protection of personal data concerning him/her.
(2) The principles and rules governing the protection of natural persons with regard to the processing of their personal data, irrespective of their nationality or residence, should respect their fundamental rights and freedoms, in particular the right to the protection of personal data. The objective of this Regulation is to contribute to the completion of the area of freedom, security and justice and economic union, to economic and social progress, to
$$$$qquad\qquad
(3) Directive 95/46/EC of the European Parliament and of the Council () aims to harmonise legislation on the protection of the fundamental rights and freedoms of natural persons with regard to processing activities and to

() OJ L 144, p. OJ C 229, 31.7.2012, p. 90. () OJ L 144, p. OJ C 391, 18.12.2012, p. 127. () Position of the European Parliament of 12 March 2014 (not yet published in the Official Journal) and Position of the Council at first reading of 8 April 2016 (not yet published in the Official Journal). Position of the European Parliament of 14 April 2016.
() Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 144, p. OJ L 281, 23.11.1995, p.31).

(4) The processing of personal data should be at the service of people. The right to the protection of personal data is not an absolute right; must be assessed in the context of its function in society and, in accordance with the principle of proportionality, must be balanced with other fundamental rights. This Regulation respects all fundamental rights and observes the freedoms and principles recognised by the Charter as enshrined in the Treaties, in particular respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, as well as cultural, religious and linguistic diversity.

(5) The economic and social integration resulting from the functioning of the internal market has led to a significant increase in cross-border flows of personal data. Across the Union, the exchange of personal data between public and private actors, including individuals, associations and businesses, has increased. Union law obliges the national authorities of the Member States to cooperate and exchange personal data in order to carry out their duties or carry out tasks on behalf of an authority of another Member State.

(6) Rapid technological developments and globalisation have brought with them new challenges for the protection of personal data. The extent to which personal data is collected and shared has increased significantly. Technology enables both private companies and public authorities to use personal data on an unprecedented scale in carrying out their activities. Individuals are increasingly disclosing their personal data, including on a global scale. Technology has changed both the economy and social life and should further facilitate the free flow of personal data within the Union and transfers to third countries and international organisations, while ensuring a high level of protection of personal data.

(7) Such developments require a strong and more coherent framework for the protection of personal data in the Union, underpinned by strong law enforcement, taking into account the need to build trust to enable the development of the digital economy across the internal market. Individuals should be able to control their own personal data. Legal and practical certainty for natural persons, economic operators and public authorities should be enhanced.

(8) Where this Regulation provides for the specification or limitation of its rules by Member State law, Member States may incorporate into their national law elements of this Regulation where necessary for reasons of consistency and for making national provisions intelligible to the persons to whom they apply.

(9) While the objectives and principles of Directive 95/46/EC continue to apply, this has not prevented fragmentation in the implementation of data protection across the Union, legal uncertainty or a widespread public perception that there are significant risks in relation to the protection of individuals, in particular with regard to activities carried out online. Differences in the level of protection of the rights and freedoms of natural persons, in particular the right to the protection of personal data, with regard to the processing of personal data in the Member States may hinder the free movement of personal data within the Union. Such differences may therefore constitute an obstacle to the exercise of economic activities at Union level, distort competition and prevent public authorities from exercising their obligations under Union law. This difference in the level of protection is due to differences in the transposition and application of Directive 95/46/EC.

(10) In order to ensure a consistent and high level of protection of natural persons and to remove obstacles to the movement of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States. Consistent and uniform application of the rules on the protection of fundamental rights and freedoms of natural persons with regard to the processing of personal data should be ensured throughout the Union. With regard to the processing of personal data for compliance with a legal obligation, the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Member States should be able to maintain or introduce national provisions in order to further specify the application of the rules of this Regulation. In conjunction with the general and horizontal data protection legislation transposing Directive 95/46/EC, there are several sector-specific pieces of legislation in the Member States in areas where more specific provisions need to be adopted. This Regulation also gives Member States some leeway to set their own rules, including rules for the processing of special categories of personal data ("sensitive personal data"). To that extent, the Regulation does not preclude the law of a Member State from determining the circumstances of the specific situations in which processing takes place, including specifying more precisely the conditions under which the processing of personal data is lawful.