372 GDPR-relevant amendments by EPP
#1 Recital 6
Authored by
Text proposed by the Commission
(6) Similarly, with the iterative regulation of online platforms over the past years, more recent rules have established a clearer and more ambitious framework than some of the predating rules, rendering them obsolete. It is therefore necessary that the legal framework evolves, eliminating any unnecessary duplications that add legal complexity.Amendment
deleted
noyb's comment:
The recital sets the objective of reducing legal complexity but is deleted.
#2 Recital 29
Authored by
Text proposed by the Commission
(29) It should be reiterated that further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. In such cases it is not necessary to ascertain on the basis of Article 6(4) of this Regulation whether the purpose of the further processing is compatible with the purpose for which the personal data are initially collected.Amendment
(29) It should be reiterated that further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. In such cases it is not necessary to ascertain on the basis of Article 6(4) of Regulation (EU) 2016/679 whether the purpose of the further processing is compatible with the purpose for which the personal data are initially collected. Such further processing should be carried out in compliance with the principles and appropriate safeguards laid down in Regulation (EU) 2016/679, in particular Article 89 thereof.
noyb's comment:
The amendment reflects existing GDPR and EDPB guidelines 1/2026.
#3 Recital 32
Authored by
Text proposed by the Commission
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
(32) The processing of personal data for scientific research purposes and the application of the provisions on scientific research of Regulation (EU) 2016/679 are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) of Regulation (EU) 2016/679. To that end, the GDPR seeks to ensure a proportionate balance between the right to protection of personal data, pursuant to Article 8 of the Charter of Fundamental Rights of the European Union (the ‘CFREU’), and the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.
#4 Recital 34
Authored by
Text proposed by the Commission
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.Amendment
(34) Processing of biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric recognition includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of their claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming their identity. Derogating from the prohibition to process biometric data under Article 9(1) of Regulation (EU) 2016/679 should be allowed where the verification of the claimed identity of the data subject is necessary and proportionate for a legitimate purpose pursued by the controller, and subject to appropriate safeguards laid down under Union law. When such verification is necessary, the controller should choose the least intrusive of the equally effective means available. The processing of biometric data for identity verification should therefore only be used where necessary and proportionate and should be subject to appropriate safeguards. That derogation should only apply where suitable safeguards apply to ensure that the biometric data are under the sole control of the data subject. Sole control means that the data subject can effectively decide when and how their biometric data are used for verification, without the controller having the technical capacity to access such biometric data in decrypted form or process them outside the strictly limited comparison process necessary for verification. For example, where the biometric data are securely stored solely on the device of the data subject or are securely stored by the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is securely held solely by the data subject and subject to measures ensuring the overall security of processing, including during the enrolment phase of the data subject’s biometric data during the verification process. Such verification may in particular be required in the context of electronic identification systems and trust services under Union law. Other examples of appropriate safeguards are ensuring that end-to-end encryption is used when data are transmitted over a communication channel and providing data subjects with the possibility to securely rectify or delete their biometric data at any time.
noyb's comment:
The amendment improves the Commission's proposal from a privacy perspective, but remains a lowering of protection compared to the current Article 9 GDPR. It adds significant work for controllers that want to use the new exemption.
#5 Recital 35
Authored by
Text proposed by the Commission
(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. By contrast, it should be clarified in Article 12 of the Regulation that the right of access, which is from the outset favourable to data subjects, should not be abused in the sense that the data subjects abuse them for purposes other than the protection of their data. For example, such an abuse of the right of access would arise where the data subject intends to cause the controller to refuse an access request, in order to subsequently demand the payment of compensation, potentially under the threat of bringing a claim for damages. Other examples of abuse include situations where data subjects make excessive use of the right of access with the only intent of causing damage or harm to the controller or when an individual makes a request, but at the same time offers to withdraw it in return for some form of benefit from the controller. Moreover, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive conduct of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abuse only to a reasonable level. In any event, while requesting access under Article 15 of Regulation (EU) 2016/679 the data subject should be as specific as possible. Overly broad and undifferentiated requests should also be regarded as excessive.Amendment
(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning them are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable them to exercise their other rights under Regulation (EU) 2016/679. Where a request is manifestly unfounded or excessive a controller should give the choice to a data subject to either pay a defined fee or have the request refused to ensure a proportionate response and avoid unexpected costs for the data subject. Rights under Regulation (EU) 2016/679 may be used as an enabler of other rights or in the public interest. The use of rights under that Regulation as an enabler of other rights or other legitimate aims should not be deemed abusive, unfounded or excessive. The broad nature of a request should not render a request unfounded or excessive. The data subject, in the exercise of their data subject rights, should be presumed to act for reasonable purposes, unless the controller unequivocally demonstrates abusive intent on the part of the data subject.
noyb's comment:
The amendment highlights the importance and broad scope of the right to access and allowing the data subject a clear choice of options if a request is deemed excessive. Clarification on the person that has that choice is simpler than the current - unclear - situation.
#6 Recital 38
Authored by
Text proposed by the Commission
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.Amendment
(38) Article 22 of Regulation (EU) 2016/679 provides that data subjects have the right not to be subject to a decision based solely on automated processing, except where specific conditions are met and in accordance with rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. However, when several equally effective automated processing solutions exist, the controller should use the less intrusive one. The data subject’s rights should not be negatively impacted by the implementation of automated individual decision-making. Human involvement with regard to automated decision-making should be meaningful, and a mere symbolic gesture by a human of viewing the decision made without having a real and factual influence on the decision-making should not be categorised as human involvement.
noyb's comment:
Clarification on serious human involvement in the decision.
#7 Recital 39
Authored by
Text proposed by the Commission
(39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches.Amendment
(39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of Regulation (EU) 2016/679, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the European Data Protection Board should establish and make public a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The Commission may adopt, by means of an implementing act, the common template as established by the Board, as well as its updates where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches.
noyb's comment:
This proposal mainly just moves some competences from the Commission to the EDPB which makes sense. But since the underlying draft by the commission lowers the level of privacy (due to increased threshold for data breach notifications) the impact is still considered bad. Since simplification on the other hand is compared to the commission proposal (the simpler of the two), the impact is neutral.
#8 Recital 40
Authored by
Text proposed by the Commission
(40) Article 35 of that Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. The lists of processing operations should be prepared by the Board and adopted by the Commission as an implementing act. In order to facilitate compliance by controllers, the Board should also prepare a common template and a common methodology for conducting data protection impact assessments, to be adopted by the Commission as an implementing act. The Commission should take due account of the proposals prepared by the Board and review them, as necessary, prior to adoption. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary.Amendment
(40) Article 35 of Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, that Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. The lists of processing operations should be established and made public by the European Data Protection Board. When establishing the lists, due account should be taken of the nature, scope, context and purposes of the processing and the risk to the rights and freedoms of natural persons. In order to facilitate compliance by controllers, the Board should also establish and make public a common template and a common methodology for conducting data protection impact assessments. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary. The Commission may adopt, by means of an implementing act, the common template as established by the Board, as well as updates to the common template, where necessary.
noyb's comment:
This amendment follows some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB without significant effect on the level of data protection or simplification.
#9 Recital 41
Authored by
Text proposed by the Commission
(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council16 applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council17 applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brough into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. __________________ 16 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). 17 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).Amendment
(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council16 applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council17 applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 should be brought into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. __________________ 16 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). 17 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).
#10 Recital 43
Authored by
Text proposed by the Commission
(43) In order to provide a strong and coherent data protection framework in the Union, the necessary adaptations of Directive (EU) 2016/680 and any other Union legal act applicable to such processing of personal data should follow after the adoption of this regulation, in order to allow for their application as close as possible to the entry into application of the amendments to Regulation (EU) 2016/679 and Regulation (EU) 2018/1725.Amendment
deleted
#35 Article 37 – paragraph 3 b (new) (Article 1 – paragraph 1 – point 18 a (new))
Authored by
Regulation (EU) 2023/2854
Article 37 – paragraph 3 b (new)
Text proposed by the Commission
Amendment
3b. Competent authorities under Article 37(1) of this Regulation shall cooperate with the supervisory authorities under Regulation (EU) 2016/679 to ensure a consistent application of both Regulations. As part of such cooperation, supervisory authorities competent under Regulation (EU) 2016/679 shall be consulted by the competent authorities under Article 37(1) of this Regulation in relation to Union and national data protection law.
noyb's comment:
Teh consultation of Data Protection Authorities should lead to better compliance with data protection compliance.
#43 Article 4 – paragraph 1 – point 32 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – paragraph 1 – point 32
Text proposed by the Commission
(32) ‘terminal equipment’ means terminal equipment as set out in Article 1(1) of Directive 2008/63/EC;Amendment
(32) ‘terminal equipment’ means terminal equipment as defined in Article 1(1) of Directive 2008/63/EC;
#44 Article 4 – paragraph 1 – point 33 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – paragraph 1 – point 33
Text proposed by the Commission
(33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply;Amendment
(33) ‘electronic communications networks’ means electronic communications networks as defined in Article 2(1) point (1) of Directive (EU) 2018/1972;
#45 Article 5 – paragraph 1 – point b (Article 3 – paragraph 1 – point 2)
Authored by
Regulation (EU) 2016/679
Article 5 – paragraph 1 – point b
Text proposed by the Commission
collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);Amendment
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the application of appropriate safeguards in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);
noyb's comment:
The amendment does not include any new substantive element, given that safeguards under Article 89 apply in any case - or not.
#46 Article 9 – paragraph 2 – point l (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point l
Text proposed by the Commission
(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.Amendment
(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the one-to-one verification is under the sole control of the data subject, subject to appropriate safeguards laid down in Union law to protect the fundamental rights and the interests of the data subject.
noyb's comment:
The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 9.
#47 Article 12 – paragraph 3 (Article 3 – paragraph 1 – point 3 a (new))
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 3
Present text
3. The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.Amendment
3a. in Article 12, paragraph 3 is replaced by the following: 3. The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension without undue delay and in any event within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
#48 Article 12 – paragraph 5 – subparagraph 1 – introductory part (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5 – subparagraph 1 – introductory part
Text proposed by the Commission
Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request.Amendment
(5) Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller shall give the data subject a choice between: (a) paying a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) their request being refused.
noyb's comment:
The amendment improves the current text and pushes back against the restriction proposed by the Commission. Clarifying the person that has that choice also makes the law clearer and hence simpler.
#49 Article 12 – paragraph 5 – subparagraph 2 (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5 – subparagraph 2
Text proposed by the Commission
The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.Amendment
The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.
noyb's comment:
With such deletion, the regime stays the same as the current GDPR.
#50 Article 12 – paragraphs 7 and 8 (Article 3 – paragraph 1 – point 4 a (new))
Authored by
Regulation (EU) 2016/679
Article 12 – paragraphs 7 and 8
Text proposed by the Commission
Amendment
4a. In Article 12, paragraphs 7 and 8 are deleted.Justification
The delegated acts for the purpose of determining the information to be presented by the icons and the procedures for providing standardised icons have never been adopted. Therefore it seems that these paragraphs are no longer needed.
noyb's comment:
The text reflects the practice. Removing "dead law" does not seem to have an impact on privacy or simplification in practice.
#51 Article 22 – paragraph 1 – introductory part (Article 3 – paragraph 1 – point 7)
Authored by
Regulation (EU) 2016/679
Article 22 – paragraph 1 – introductory part
Text proposed by the Commission
1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision:Amendment
1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or that similarly significantly affects them, unless such processing:
noyb's comment:
The amendment changes the Article back towards the current wording of the GDPR. A significant impact of the wording ("right" versus a duty) is not apparent.
#52 Article 22 – paragraph 1 – point b (Article 3 – paragraph 1 – point 7)
Authored by
Regulation (EU) 2016/679
Article 22 – paragraph 1 – point b
Text proposed by the Commission
(b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; orAmendment
(b) is authorised by Union or Member State law to which the controller is subject and which lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or
#53 Article 22 – paragraph 3 (Article 3 – paragraph 1 – point 7 a (new))
Authored by
Regulation (EU) 2016/679
Article 22 – paragraph 3
Present text
3. In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.Amendment
7a. In Article 22, paragraph 3 is replaced by the following: 3. In the cases referred to in points (a) and (c) of paragraph 1, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain meaningful human intervention on the part of the controller, to express his or her point of view and to challenge the decision taken in respect of them. Meaningful human intervention on the part of the controller requires that the human reviewer has the authority, knowledge, and competence to modify the contested decision, and that they actively analyse all relevant data, not merely the output of the system.
noyb's comment:
Improves the protection of users, highlighting that human intervention must be meaningful. This 'human in the loop' principle would however increase workloads for controllers.
#54 Article 33 – paragraph 1 (Article 3 – paragraph 1 – point 8 – point a)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 1
Text proposed by the Commission
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.Amendment
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56 of this Regulation. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.
noyb's comment:
No material changes to the Commission's proposal. References to "this Regulation" are not common within the GDPR.
#55 Article 33 – paragraph 1 a (Article 3 – paragraph 1 – point 8 – point b)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 1 a
Text proposed by the Commission
1a. Until the establishment of the single-entry point pursuant to Article 23a of Directive (EU) 2022/2555, controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article 56.Amendment
1a. Until the establishment of the single-entry point pursuant to Article 23a of Directive (EU) 2022/2555, controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article 56 of this Regulation.
noyb's comment:
No material changes to the Commission's proposal. References to "this Regulation" are not common within the GDPR.
#56 Article 33 – paragraph 6 (Article 3 – paragraph 1 – point 8 – point c)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 6
Text proposed by the Commission
6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).Amendment
6. By …[PO please insert date: nine months from the entry into application of this amending Regulation] the Board shall establish and make public a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission may adopt the template as established by the Board by way of an implementing act in accordance with the examination procedure set out in Article 93(2) of this Regulation.
noyb's comment:
This proposal moves some competences from the commission to the EDPB without significant effect on privacy or simplification.
#57 Article 33 – paragraph 7 (Article 3 – paragraph 1 – point 8 – point c)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 7
Text proposed by the Commission
7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6.Amendment
7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Commission may adopt necessary updates of the template by way of an implementing act following the procedure referred to in paragraph 6.
noyb's comment:
This proposal seems to be related with the move of competences to the EDPB. Providing no significant change in the level of privacy or simplification.
#58 Article 35 – paragraph 4 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 4
Text proposed by the Commission
4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.Amendment
4. By …[PO please insert date: nine months from the entry into application of this amending Regulation] the Board shall establish and make public: (a) a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1; (b) a list of the kind of processing operations for which no data protection impact assessment is required; (c) a common template and a common methodology for conducting data protection impact assessments.
noyb's comment:
Compared to the Commission’s proposal, this amendment not only shifts some competences to the EDPB, it also moves a white-list and a template the Boards shall establish to this provision. Such templates and white-lists do simplify compliance.
#59 Article 35 – paragraph 5 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 5
Text proposed by the Commission
5. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.Amendment
deleted.
noyb's comment:
Deletion of Commission's proposal - related to adding the same content in another provision.
#60 Article 35 – paragraph 6 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 6
Text proposed by the Commission
6. The Board shall prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments.Amendment
deleted
noyb's comment:
Deletion of Commission's proposal - related to adding the same content in another provision.
#61 Article 35 – paragraph 6 a (Article 3 – paragraph 1 – point 9 – point b)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 6 a
Text proposed by the Commission
6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).Amendment
6a. The Commission may adopt the template as established by the Board by way of an implementing act in accordance with the examination procedure set out in Article 93(2) of this Regulation.
noyb's comment:
This amendment is related to some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB without significant effect on the level of data protection or simplification.
#62 Article 35 – paragraph 6 b (Article 3 – paragraph 1 – point 9 – point b)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 6 b
Text proposed by the Commission
6b. The lists and the template and methodology referred to in paragraph 6a- shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6a.Amendment
6b. The lists and the template and methodology referred to in paragraph 4 shall be reviewed by the Board at least every three years and updated where necessary. The Commission may adopt any updates of the template by way of an implementing act in accordance with the procedure referred to in paragraph 6a.
noyb's comment:
This amendment is related to some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB without significant effect on the level of data protection or simplification.
#63 Article 35 – paragraph 6 c (Article 3 – paragraph 1 – point 9 – point b)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 6 c
Text proposed by the Commission
6c. Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Commission adopts the implementing act referred to in paragraph 6a.Amendment
6c. Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Board establishes and makes public the lists referred to in paragraph 4, points (a) and (b).
noyb's comment:
This amendment is related to some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB without significant effect on the level of data protection or simplification.
#64 Article 70 – paragraph 1 – point h a (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point h a
Text proposed by the Commission
(ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35.Amendment
(ha) establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35.
noyb's comment:
This amendment seems related to a separate amendment of Article 35 which follows some considerations of the EDPB/EDPS opinion and shifts competences to the EDPB.
#65 Article 70 – paragraph 1 – point h b (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point h b
Text proposed by the Commission
(hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.Amendment
(hb) establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.
noyb's comment:
This amendment seems related to a separate amendment of Article 35 which follows some considerations of the EDPB/EDPS opinion and shifts competences to the EDPB.
#66 Article 70 – paragraph 1 – point h c (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point h c
Text proposed by the Commission
(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33Amendment
(hc) establish a common template for notifying a personal data breach to the competent supervisory authority as well as a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33.
noyb's comment:
This amendment seems related to a separate amendment of Article 35 which follows some considerations of the EDPB/EDPS opinion and shifts competences to the EDPB.
#67 Article 70 – paragraph 3 (Article 3 – paragraph 1 – point 14 a (new))
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 3
Present text
3. The Board shall forward its opinions, guidelines, recommendations, and best practices to the Commission and to the committee referred to in Article 93 and make them public.Amendment
14a. in Article 70, paragraph 3 is replaced by the following: 3. The Board shall forward its opinions, guidelines, recommendations, templates, lists and best practices to the Commission and to the committee referred to in Article 93 and make them public.
noyb's comment:
This amendment seems related to a separate amendment of Article 35 which follows some considerations of the EDPB/EDPS opinion and shifts competences to the EDPB.
#83 Recital 2
Authored by
Text proposed by the Commission
(2) Union digital legislation sets high standard in the Union and can be a powerful source of competitive advantage for businesses that abide by the rules, showing a world-leading mark of quality, safety and trustworthiness. Digital regulations have framed the clear rules of the game in the Union for responsible businesses, ensuring fairness and transparency in business-to-business relations, stimulating innovative business models, setting high standard of consumer protection and safety, and for the protection fundamental rights, not least privacy and data protection.Amendment
(2) Union digital legislation sets high standard in the Union and can be a powerful source of competitive advantage for businesses that abide by the rules, showing a world-leading mark of quality, safety and trustworthiness. Digital regulations have framed the clear rules of the game in the Union for responsible businesses, ensuring fairness and transparency in business-to-business relations, stimulating innovative business models, setting high standard of consumer protection and safety, and for the protection fundamental rights, not least privacy and data protection. At the same time, the growing volume and complexity of digital regulations have increased the regulatory and administrative burden on Union businesses, thereby undermining their competitiveness.
noyb's comment:
Narrative without direct factual basis. Amounts to a political statement in a non-binding recital. No direct impact on simplification or privacy.
#87 Recital 3
Authored by
Text proposed by the Commission
(3) Union digital legislation has evolved incrementally over the past years, in response to the rapidly growing footprint of digital technologies in the Union’s economy and societal dynamic, and in view of addressing emerging challenges and promoting business opportunities in the EU. Notwithstanding the Commission’s commitment to a systematic ‘stress test’ of the digital rules, along with other Union rules, which might lead to further regulatory adjustments notably following the forthcoming Digital Fitness Check, as well as other targeted evaluations of digital rules, immediate regulatory changes are necessary. Consequently, this Regulation proposes a first set of amendments to the digital legislative framework, aimed at providing immediate regulatory clarifications that stimulate innovation in the Union market, and that cut administrative compliance costs in particular for businesses, while also streamlining supervisory and administrative costs for supervisory authorities and advisory bodies. The amendments also seek to provide clarity to individuals.Amendment
(3) Union digital legislation has evolved incrementally over the past years, in response to the rapidly growing footprint of digital technologies in the Union’s economy and societal dynamic, and in view of addressing emerging challenges and promoting business opportunities in the EU. Notwithstanding the Commission’s commitment to a systematic ‘stress test’ of the digital rules and potential overlaps of requirements, along with other Union rules, which might lead to further regulatory adjustments notably following the forthcoming Digital Fitness Check, as well as other targeted evaluations of digital rules, immediate regulatory changes are necessary. This Regulation should be seen as a first step towards further simplification of the Digital Rulebook and further efforts to reduce fragmented enforcement of Union rules. Consequently, this Regulation proposes a first set of amendments to the digital legislative framework, aimed at providing immediate regulatory clarifications that stimulate innovation in the Union market, and that cut administrative compliance costs in particular for businesses, while also streamlining supervisory and administrative costs for supervisory authorities and advisory bodies. The amendments also seek to provide clarity to individuals.
noyb's comment:
Amounts to a political wish for future simplification and consistent enforcement. No direct impact on the law.
#103 Recital 5
Authored by
Text proposed by the Commission
(5) Acknowledging the iterative evolution of horizontal and sector-specific rules, it is indispensable to address also overlaps in specific provisions that result in unnecessary duplications of administrative burdens. This is the case in requirements across several rules for reporting following cybersecurity and related incidents, where digital solutions, as proposed in this Regulation, can bring an immediate relief to businesses across all concerned sectors.Amendment
(5) Acknowledging the iterative evolution of horizontal and sector-specific rules, it is indispensable to address also overlaps in specific provisions that result in unnecessary duplications of administrative burdens and increased legal complexity. This is the case in requirements across several rules for reporting following cybersecurity and related incidents, where digital solutions, as proposed in this Regulation, can bring an immediate relief to businesses across all concerned sectors.
#216 Recital 27
Authored by
Text proposed by the Commission
(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council15 . The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act. _________________ 15 Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (OJ L, 2025/327, 5.3.2025, ELI: http://data.europa.eu/eli/reg/2025/327/oj)Amendment
(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given person or entity where that person or entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council. It should also be clarified that information, which is apparently impersonal, may still be considered personal data if the data subject can be identified with additional information obtained from another person or entity through means reasonably likely to be used making it possible to identify the data subject. In such circumstances, the fact that the information enabling the data subject to be identified is in the hands of other people does not prevent that data subject from being identifiable for the controller. The Court of Justice of the European Union has also held that information which are in themselves impersonal may become personal in nature where the controller puts them, or is likely to put them, at the disposal of other persons or entities who have means reasonably likely to enable the data subject to be identified. It is apparent, in particular, that if that information is put at these other persons or entities’ disposal – then this information is personal data for these persons and entities and, indirectly, for the controller. Accordingly, in so far as it cannot be ruled out that those persons or entities have means reasonably allowing them to attribute pseudonymised data to the data subject, such as cross-checking with other data at their disposal, the data subject must be regarded as identifiable as regards both that transfer and any subsequent processing of those data by those persons and entities. In such circumstances, pseudonymised data should be considered to be personal data. The Commission, together with the European Data Protection Board, may support controllers in the application of this updated definition by stipulating technical criteria in an implementing act.
noyb's comment:
The Parliament's amendment improves the Commission’s proposal that is meant to introduce a subjective approach to the definition of personal data. However, even with the new protections that this amednment seeks to afford, while it highlights an objective approach, it seems partly contradictory and does not go beyond the current understanding of the GDPR.
#220 Recital 27
Authored by
Text proposed by the Commission
(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council15 . The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act. _________________ 15 Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (OJ L, 2025/327, 5.3.2025, ELI: http://data.europa.eu/eli/reg/2025/327/oj)Amendment
(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable for a given entity. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council15 . The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act. (Recital 27 - Regulation (EU) 2016/679) _________________ 15 Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (OJ L, 2025/327, 5.3.2025, ELI: http://data.europa.eu/eli/reg/2025/327/oj)
noyb's comment:
The amendment does not include any new substantive element, it merely further emphasises the Commission's proposed subjective nature of Article 4(1).
#224 Recital 27 a (new)
Authored by
Text proposed by the Commission
Amendment
(27a) Regulation (EU) 2016/679 already has elements of a risk-based approach. However, especially small and medium enterprises cannot benefit from a risk-based approach if the necessary legal certainty is not provided through clear thresholds. To increase the legal certainty for more limited processing the objective categories for small, medium and large processers is introduced. Small controllers are all controllers that have or will process the data of less than [100.000] data subjects in the pending or preceding financial year, including short-term transactional processing. As a default the current rules in the Regulation are maintained and controllers are deemed a medium controller. A controller may only benefit from the privileges for small controllers if there is positive knowledge about fulfilling the criteria. Controllers like hospitals or Unions that by their very nature process large numbers of sensitive data under Article 9 or 10 of Regulation (EU) 2016/679 shall not be deemed a small controller. While small controllers must not comply with many administrative requirements of the Regulation, the rights of data subjects, which are largely based on Article 8(2) of the Charter are not altered. Given the existing burden of proof of controllers, the lack of formal documentation shall not limit the effective enforcement of data subjects’ rights. In the rare case of a complaint or procedure against a small controller, they may proof compliance with any formal or informal evidence according to national procedural law.Justification
RISK-BASED APPROACH #1: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
Clear thresholds would simplify the application of the law. Nevertheless, SMEs would have more limited obligations, which would typcially (indirectly) limit the rights of data subjects.
#227 Recital 27 a (new)
Authored by
Text proposed by the Commission
Amendment
(27a) Pseudonymised data should be presumed not to constitute personal data for an entity that has no lawful means of access to the additional information necessary for identification and no means reasonably likely to be used to identify the natural person, in line with the case-law of the Court of Justice of the European Union. That relative approach provides legal certainty for the sharing of data for research, statistics and the development of artificial intelligence, without lowering the level of protection where identification remains reasonably likely.
noyb's comment:
The amendment includes a derogation in relation to Article 4(5) which is not foreseen in the current regime. Pseudonymized data is typically covered by Article 8 of the Charter. A pure "relative" approach hence violates the Charter.
#229 Recital 27 b (new)
Authored by
Text proposed by the Commission
Amendment
(27b) At the same time the rules in Regulation (EU) 2016/679 have proven to be too lenient for very large controllers, such as data brokers or large platforms. Hence a category of large controllers is introduced to ensure more stringent rules of controllers with large processing operations. Large controllers shall for example be regularly inspected, face increased transparency and reporting obligations. Large controllers are defined by absolute or relative number of data subjects in any given Member State, to include dominant controllers in all Member States. A national list of such large controllers shall allow supervisory authorities and the public to have transparency about relevant controllers.Justification
RISK-BASED APPROACH #2: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
The recital has a potential of 1) working in the favor of fundamental rights of data subjects by designating VLOPs and giving them more reporting and transparency obligations; and 2) mandating closer cooperation between VLOPs and local authorities which can lead to better communication and expectation management between the two. How this is implemented in actuality is dependent on the wording in the law itself.
#231 Recital 27 c (new)
Authored by
Text proposed by the Commission
Amendment
(27c) Given the limited resource of supervisory authorities, large controllers shall be certified for compliance with Regulation (EU) 2016/679 each year. To ensure a high level of protection and to ensure that certification bodies that knowingly and repeatedly certified conduct that was clearly or foreseeably unlawful, new options for the revocation of accreditation are introduced.Justification
RISK-BASED APPROACH #3: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
Improved enforcement and simplification by introducing an enforcement system for very large controllers.
#239 Recital 28
Authored by
Text proposed by the Commission
(28) In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as methodological and systematic approach applied while conducting the research in the specific area. Research and technology development should be conducted in academic, industry and other settings, including small and medium-sized undertakings, (Article 179(2) TFEU) and should be always of a of high quality and should adhere to the principles of principles of reliability, honesty, respect and accountability (verifiability).Amendment
(28) In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as methodological and systematic approach applied while conducting the research in the specific area. Research and technology development should be conducted in academic, industry and other settings, including small and medium-sized undertakings, (Article 179(2) TFEU) and should be always of a of high quality and should adhere to the principles of principles of reliability, honesty, respect and accountability (verifiability). This does not exclude scientific research activities that further commercial interests.
noyb's comment:
Clarification but widening scope of privileged data processing.
#240 Recital 28
Authored by
Text proposed by the Commission
(28) In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as methodological and systematic approach applied while conducting the research in the specific area. Research and technology development should be conducted in academic, industry and other settings, including small and medium-sized undertakings, (Article 179(2) TFEU) and should be always of a of high quality and should adhere to the principles of principles of reliability, honesty, respect and accountability (verifiability).Amendment
(28) In order to assess whether an activity meets the conditions of being scientific research for the purpose of this Regulation, account should be taken of the following characteristics: novelty, creativity, uncertainty, systematic and transferable/reproducible. Consideration should also be given to the purpose of the activity, which should primarily aim at new findings, based on original concepts (and their interpretation) or hypotheses. The Frascati Manual will be the main reference for this assessment.
noyb's comment:
Seems like an attempt to clarify scientific research in more detail, however the impact seems to be rather limited.
#248 Recital 29
Authored by
Text proposed by the Commission
(29) It should be reiterated that further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. In such cases it is not necessary to ascertain on the basis of Article 6(4) of this Regulation whether the purpose of the further processing is compatible with the purpose for which the personal data are initially collected.Amendment
(29) It should be reiterated that further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. In such cases it is not necessary to ascertain on the basis of Article 6(4) of this Regulation whether the purpose of the further processing is compatible with the purpose for which the personal data are initially collected. The controller does not require a new legal basis for further compatible processing or derogation under Article 9(2), subject to the application of appropriate safeguards in accordance with Article 89(1).
noyb's comment:
The presumption of compatibility for sensitive data is foreseen in EDPB guidelines 1/2026. However, Article 8(2) of the Charter foresees a legal basis and purpose limitation, which seems to be entirely overturned for any research here.
#259 Recital 30
Authored by
Text proposed by the Commission
(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. This Regulation shall not apply to AI systems developed exclusively by competent authorities within the meaning of Directive (EU) 2016/680 for their own operational use in the prevention, detection, investigation or prosecution of criminal offences, provided that such systems are not placed on the market or made available to third parties. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.
noyb's comment:
This amendment woudl limit the scope of Directive (EU) 2016/680.
#261 Recital 30
Authored by
Text proposed by the Commission
(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. To develop and use reliable AI systems, it is necessary to improve access to qualitative data in Europe. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.
noyb's comment:
The purpose of the proposed addition is unclear, but hints at allowing access to (personal) data for AI training.
#262 Recital 30
Authored by
Text proposed by the Commission
(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest of the controller or a third party within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Justification
This amendment aligns Recital (30) with Article 88c by clarifying that legitimate interests under Article 6(1)(f) GDPR may be pursued by both controllers and third parties. It removes ambiguity for AI supply chains, ensures consistency between the recital and the operative text, and replaces the broad reference to "Article 6" with the more precise reference to Article 6(1)(f), improving legal certainty and coherent interpretation.
noyb's comment:
The amendment does not add/remove something from the Commission's proposal, which generally lowers the level of protection.
#264 Recital 30 a (new)
Authored by
Text proposed by the Commission
Amendment
(30a) The simplification of the Union's digital acquis, including of Regulation (EU) 2024/1689, should not be a one-off exercise but a continuous task. This Regulation and the parallel proposal amending Regulation (EU) 2024/1689 (Digital Omnibus on AI) constitute only first steps towards a simpler, innovation-friendly regulatory framework. In line with the Union's targets of reducing administrative costs by at least 25 %, and by at least 35 % for SMEs, the Commission should continuously monitor the administrative burden arising from the digital acquis, in particular for SMEs and small mid-cap companies. As a next step, the Commission should present a broader and more comprehensive digital simplification package, covering the whole digital acquis.
noyb's comment:
The recital does not highlight fundamental rights. On the contrary, it highlights innovation and the need to overhaul the EU digital acquis. However, it highlights simplifiction..
#266 Recital 30 a (new)
Authored by
Text proposed by the Commission
Amendment
(30a) When applying Union rules on artificial intelligence to competent authorities for the prevention, investigation, detection or prosecution of criminal offences, unnecessary duplication of legal and administrative obligations should be avoided. Such authorities already operate within the comprehensive safeguards established by Directive (EU) 2016/680 and national constitutional oversight mechanisms. Regulatory requirements should therefore remain proportionate and should not create overlapping compliance structures which reduce operational capacities without providing an equivalent increase in the protection of fundamental rights.
noyb's comment:
Highlighting the limtiations of the GDPR. While this can be read as a mere restatement, it can have impact in business-to-governemnt processing situations, that can be covered by the GDPR so far.
#267 Recital 30 b (new)
Authored by
Text proposed by the Commission
Amendment
(30b) In particular, the application of obligations designed primarily for economic operators placing AI systems on the internal market should not impose disproportionate administrative burdens on competent public authorities using AI systems exclusively for the exercise of public powers in accordance with Union and national law. Simplification measures should preserve the operational effectiveness of law enforcement authorities, especially where AI supports the fight against organised crime, terrorism and child sexual abuse.
noyb's comment:
Highlighting the limtiations of the GDPR. While this can be read as a mere restatement, it can have impact in business-to-governemnt processing situations, that can be covered by the GDPR so far.
#268 Recital 30 c (new)
Authored by
Text proposed by the Commission
Amendment
(30c) Member States may provide that, where AI systems are developed, tested, validated or deployed by competent authorities within the meaning of Directive (EU) 2016/680 for the prevention, detection, investigation or prosecution of criminal offences, such processing may be considered to pursue an important public interest, provided that appropriate safeguards under Union and national law apply.
noyb's comment:
Highlighting the limtiations of the GDPR. While this can be read as a mere restatement, it can have impact in business-to-governemnt processing situations, that can be covered by the GDPR so far.
#275 Recital 31
Authored by
Text proposed by the Commission
(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, providing an unconditional right to object to the processing of their personal data, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.Amendment
(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services.
noyb's comment:
The propose amendment intends to further decrease data subject rights, specifically the proposed by the Commission unconditional right to object.
#278 Recital 31
Authored by
Text proposed by the Commission
(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, providing an unconditional right to object to the processing of their personal data, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.Amendment
(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects' rights such as providing enhanced transparency to data subjects, ensuring that data subjects are informed of their right to object to the processing of their personal data in accordance with Article 21 of Regulation (EU) 2016/679, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.Justification
This amendment aligns Recital (31) with Article 88c and the GDPR by removing the reference to an "unconditional right to object." Article 21 GDPR already regulates the right to object with defined conditions and limitations. Keeping the current recital would create inconsistency with the operative provisions, undermine legal certainty, and conflict with the Data Omnibus objective of providing a clear and coherent legal framework.
noyb's comment:
The proposed amendment suggesting to remove the unconditional character of the right to object to AI processing operations diminishes the data subjects' control over their personal data.
#280 Recital 31
Authored by
Text proposed by the Commission
(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, providing an unconditional right to object to the processing of their personal data, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.Amendment
(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.
noyb's comment:
The proposed amendment suggesting to remove the unconditional character of the right to object to AI processing operations diminishes the data subjects' control over their personal data.
#282 Recital 32
Authored by
Text proposed by the Commission
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. Directive (EU) 2016/680 constitutes the lex specialis governing the processing of personal data by competent authorities for law enforcement purposes and provides the specific data protection framework applicable to such processing. The obligations laid down in this Regulation should therefore be interpreted and applied in a manner that avoids unnecessary duplication of safeguards and administrative obligations already ensured under Directive (EU) 2016/680 and national law. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.
#284 Recital 32
Authored by
Text proposed by the Commission
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
(32) The adoption of appropriate safeguards ensuring the rights and freedoms of data subjects pursuant to Article 89(1) Regulation (EU) 2016/679, is necessary in order to process personal data for scientific research purposes and to apply the provisions on scientific research of Regulation (EU) 2016/679. To that end, the GDPR seeks to ensure a proportionate balance between the right to protection of personal data, pursuant to Article 8 of the Charter of Fundamental Rights of the European Union (the ‘CFREU’), and the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.
#289 Recital 32
Authored by
Text proposed by the Commission
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR seeks to ensure a proportionate balance between the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.
#291 Recital 32 a (new)
Authored by
Text proposed by the Commission
Amendment
(32a) The possibility of drawing conclusions regarding a data subject's health status through the combination, analysis or contextual interpretation of other data should not, in itself, result in the classification of such data as data concerning health for the purposes of Article 9. Data should only fall within the special category referred to in Article 9(1) where it directly and inherently discloses information concerning health, and not merely because such information could, in principle, be derived from it by a third party through further processing, enrichment or analysis.
noyb's comment:
The amendment restrains the scope of the definition in Article 9.
#292 Recital 32 a (new)
Authored by
Text proposed by the Commission
Amendment
(32a) To ensure legal certainty and support innovation, the processing of health data by a processor for the purposes of improving, maintaining, testing, ensuring the security of, or enhancing the performance of systems, models or services provided to a controller should not, in itself, result in that processor being considered a controller or joint controller, where such processing is carried out on behalf of the controller, within the purposes and scope determined by the controller, and subject to appropriate safeguards.
noyb's comment:
The amendment highlights innovation and creates a subjective test for the definition of controller.
#300 Recital 33
Authored by
Text proposed by the Commission
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.Amendment
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including which may include personal data and special categories thereof. Special categories of personal data may incidentally and residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing and while the controller did not intend to process such personal data and has taken the appropriate technical and organisational measures to avoid such processing, such as the filtering out of special categories of personal data at the collection stage. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, including technical capabilities derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed for incidental and residual processing of special categories of data in the context of the development and technical operation of AI systems or AI models. The derogation should not be understood as covering the processing of special categories of personal data directly acquired by or provided to the AI system or AI model in the course of the deployment. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle, such as the development and operation, of an AI system or AI model, and, once it identifies such data, effectively remove them. If removal would require manifestly disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model the controller should effectively protect such data from being further processed or processed for other purposes, in particular used to infer outputs, being disclosed or otherwise made available to third parties. The controller should document its assessment and have processes in place to monitor and demonstrate the effectiveness of these measures. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing, for example if special categories of personal data relating to a natural person’s voice, image or other personal characteristics are used in a way that goes beyond incidental or residual existence. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679 or in another Union law, such as Regulation (EU) 2024/1689 regarding the processing of special categories of personal data for the purpose of ensuring bias detection and correction. The notion of AI system and AI model should be understood in the same manner as in Regulation (EU) 2024/1689.
noyb's comment:
This amendment goes further than the Commission's proposal, but in certain aspects takes a step back from the GDPR (e.g. development & operation of AI). Overall mixed direction.
#305 Recital 33
Text proposed by the Commission
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.Amendment
(33) The development, training, testing, validation, deployment, operation and monitoring of AI systems and AI models may require the processing of personal data. Such processing may constitute a legitimate interest of the controller or a third party within the meaning of Article 6(1), point (f), where appropriate, provided that the interests or fundamental rights and freedoms of the data subject do not override that interest, taking particular account of whether the data subject is a child. Where public authorities process personal data for the performance of a task carried out in the public interest or in the exercise of official authority vested in them, Article 6(1), point (e), in conjunction with Union or Member State law referred to in Article 6(3), should remain the appropriate legal basis. Controllers should use non-personal or anonymised data where the intended purpose can reasonably and effectively be achieved by using such data. Where the processing of personal data is necessary, pseudonymised data should be used wherever the intended purpose can reasonably and effectively be achieved by using such data. Appropriate technical and organisational measures should be implemented throughout the lifecycle of the AI system or AI model. Such measures should include data minimisation during the selection of sources and the training, testing and validation of the system or model, the use of state-of-the-art privacy-enhancing technologies, and measures to prevent memorisation, regurgitation, data leakage and the unauthorised disclosure of personal data through outputs. Personal data should only be included in an output where this is necessary for the intended purpose, the recipient is authorised to receive those data and the disclosure has a legal basis under Article 6 and, where applicable, Article 9. Particular protection should be afforded to special categories of personal data referred to in Article 9(1).
noyb's comment:
This proposed amendment does not go far beyond the Omnibus proposal. It allows the new limitation to the GDPR and only repeats existing requirements (mainly implementations of data minimization) as safeguards.
#308 Recital 33
Authored by
Text proposed by the Commission
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.Amendment
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures to mitigate the risk of the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, is notified of or itself identifies such data, implement technically and economically feasible measures to cease processing. If cessation of processing would require disproportionate effort, notably where the cessation of processing of special categories of data memorised in the AI system or AI model would require reengineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.Justification
This amendment aligns Recital (33) with the revised Article 9(5) by replacing obligations to "avoid" and "remove" special categories of personal data with proportionate duties to mitigate risks and cease processing through technically and economically feasible measures. It ensures consistency between the recital and the operative text, prevents overly restrictive interpretation, and clarifies that controllers must act when such data is identified or reported by third parties.
noyb's comment:
This amendment proposes that the controller only implements measures that are "economically feasible".
#310 Recital 33 a (new)
Authored by
Text proposed by the Commission
Amendment
(33a) To ensure legal certainty and support the responsible development and use of artificial intelligence in the Union, it should be clarified that processing of personal data in the context of development, deployment, training, testing, operation and improvement of AI systems or models, including related products and services, may constitute a lawful ground under this Regulation where the conditions laid down in Article 9(2), point (k), are met.
#314 Recital 34
Authored by
Text proposed by the Commission
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.Amendment
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, is personal data that result from processing certain characteristics of a natural person through a specific technical means, and that allow or confirm the unique identification of that person. The notion of biometric recognition includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of their claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming their identity. Derogating from the prohibition to process biometric data under Article 9(1) of Regulation (EU) 2016/679 should be allowed where the verification of the claimed identity of the data subject is necessary and proportionate for a legitimate purpose pursued by the controller, and subject to appropriate safeguards laid down under Union law. The required proportionality entails choosing the least intrusive of the equally effective means available. The appropriate safeguards shall ensure that the biometric data are under the sole control of the data subject so that the data subject can effectively decide when and how their biometric data are used for verification, without the controller having the technical capacity to access such biometric data in decrypted form or process them outside the strictly limited comparison process necessary for verification. This would for example be the case where the biometric data are securely stored solely on the device of the data subject or are securely stored by the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is securely held solely by the data subject and subject to measures ensuring the overall security of processing, including during the enrolment phase of the data subject’s biometric data during the verification process. Such verification may in particular be required in the context of electronic identification systems and trust services under Union law. Other examples of appropriate safeguards are ensuring that end-to-end encryption is used when data are transmitted over a communication channel and providing data subjects with the possibility to securely rectify or delete their biometric data at any time.Justification
Redrafted to align with the definition of biometric data in Article 4(14) GDPR.
noyb's comment:
The amendment improves the Commission's proposal by reducing its scope of application but remains a decrease of protection compared to the current Article 9.
#316 Recital 34
Authored by
Text proposed by the Commission
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.Amendment
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means either allowing the unique identification of or confirming the identify of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification of his or her claimed identity, which rely on different technical processes. ‘Biometric identification’ means the automated recognition of a person’s physical, physiological, behavioural, or psychological features for the purpose of establishing his or her identity by comparing biometric data of that individual to that of other individuals recorded in a database. ‘Biometric verification’ means the automated, one-to-one verification, including authentication, of the identity of a natural person by comparing his or her biometric data to previously provided biometric data. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is carried out for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process. However, where justified by the operational and security requirements of strategic public transport infrastructure, the biometric data may be retained under the controller’s responsibility, provided that the controller guarantees a high level of personal data protection. Such processing should only be authorised if it is strictly necessary, proportionate to the aim pursued and carried out with respect for the rights and freedoms of the data subjects.
noyb's comment:
The amendment supports and for some aspects, goes even further than the Commission's proposal, which decreases the protection under the current Article 9.
#320 Recital 34
Authored by
Text proposed by the Commission
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.Amendment
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. Derogating from the prohibition to process biometric data under Article 9(1) of Regulation (EU) 2016/679 should be allowed where data subject is offered a non-biometric alternative and suitable safeguards are implemented to ensure fundamental rights of the data subject are adequately protected through the implementation of the necessary safeguards. For example, this is the case, where the biometric data is securely stored by the device of the data subject, or the biometric data is securely stored by the controller in a encrypted form and the encryption key or equivalent means is securely held the data subject, and subject to measures ensuring the overall security of the processing, including during the enrolment phase of data subject and at the time when the data subject agrees to share the biometric data or encryption key. Other examples of appropriate safeguards are ensuring that end-to-end encryption, or similar state of the art technology, is used when data are transmitted over a communication channel and providing data subjects with the possibility to securely erase their biometric data in accordance with Article 17 of Regulation (EU) 2016/679.Justification
Biometric identification can enable trusted digital identity services, including the European Digital Identity Wallet, but requires clear safeguards. The amendment provides legal certainty for voluntary biometric use where a comparable non-biometric alternative is available and fundamental rights are protected. Secure local storage, encryption controlled by the data subject, secure enrolment and transmission, and erasure options ensure user control, privacy and security by design while supporting responsible European innovation.
noyb's comment:
The amendment almost goes back to a consent requirement, like under the current text, and includes an obligation to provide a less intrusive alternative.
#321 Recital 34
Authored by
Text proposed by the Commission
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.Amendment
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should be allowed where the data subject is offered a non-biometric alternative and suitable safeguards are implemented to ensure fundamental rights of the data subject are adequately protected through the implementation of the necessary safeguards. For example, where the biometric data are securely stored solely by the device the side of the data subject, or the biometric data is are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, and subject to measures ensuring the overall security of the processing, including during the enrolment phase of data subject and at the time when the data subject agrees to share the biometric data or encryption key. Other examples of appropriate safeguards are ensuring that end-to-end encryption, or similar state of the art technology, is used when data are transmitted over a communication channel and providing data subjects with the possibility to securely erase their biometric data in accordance with Article 17 of Regulation (EU) 2016/679.
noyb's comment:
The amendment almost goes back to a consent requirement, like under the current text, and includes an obligation to provide a less intrusive alternative.
#331 Recital 35
Authored by
Text proposed by the Commission
(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. By contrast, it should be clarified in Article 12 of the Regulation that the right of access, which is from the outset favourable to data subjects, should not be abused in the sense that the data subjects abuse them for purposes other than the protection of their data. For example, such an abuse of the right of access would arise where the data subject intends to cause the controller to refuse an access request, in order to subsequently demand the payment of compensation, potentially under the threat of bringing a claim for damages. Other examples of abuse include situations where data subjects make excessive use of the right of access with the only intent of causing damage or harm to the controller or when an individual makes a request, but at the same time offers to withdraw it in return for some form of benefit from the controller. Moreover, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive conduct of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abuse only to a reasonable level. In any event, while requesting access under Article 15 of Regulation (EU) 2016/679 the data subject should be as specific as possible. Overly broad and undifferentiated requests should also be regarded as excessive.Amendment
(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. By contrast, it should be clarified in Article 12 of the Regulation that the right of access, which is from the outset favourable to data subjects, should not be abused in the sense that the data subjects abuse them for purposes other than the protection of their data. For example, such an abuse of the right of access would arise where the data subject intends to cause the controller to refuse an access request, in order to subsequently demand the payment of compensation, potentially under the threat of bringing a claim for damages. Other examples of abuse include situations where data subjects make excessive use of the right of access with the only intent of causing damage or harm to the controller or when an individual makes a request, but at the same time offers to withdraw it in return for some form of benefit from the controller. Moreover, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive conduct of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abuse only to a reasonable level. In this regard, when exercising his or her right of access under Article 15 of Regulation (EU) 2016/679, the data subject must specify the precise scope of his or her request, as well as the specific justification for it, to allow the controller to assess whether it is reasonable. In any event, the data subject should be as specific as possible. Overly broad and undifferentiated requests should also be regarded as excessive.
noyb's comment:
The amendment goes further than the restrictions proposed by the Commission.
#347 Recital 36 a (new)
Authored by
Text proposed by the Commission
Amendment
(36a) To reduce administrative burdens for civil-society and volunteer-based organisations, associations and non-profit entities should not be subject to the full scope of the regulation and in particular not of information and record-keeping obligations of Regulation 2016/679, provided their data processing is limited to low-risk internal administrative purposes and does not involve systematic monitoring or high-risk operations. Member States should ensure that such entities can fulfil transparency obligations through general public information rather than individual notices
noyb's comment:
Reducing the scope for certain organisations simplifies GDPR compliance for those organisations while reducing the level of data protection. E.g. certain data subjects would not be informed about the processing of their data.
#357 Recital 37
Text proposed by the Commission
(37) Where the processing takes place for the purpose of scientific research and the provision of information to the data subject proves to be impossible or would involve a disproportionate effort it should not be necessary to provide the information provided for under Article 13 of this Regulation. The controller should make reasonable efforts to acquire contact details if they are readily available and acquisition would not require a disproportionate effort. The provision of the information would involve a disproportionate effort in particular where the controller at the time of collection of the personal data did not know or anticipate that it would process personal data for scientific research purposes at a later stage, in which case it may not have easily available contact details of the data subjects. In such situations the controller should inform data subjects indirectly, such as by making the information publicly available. The provision of such information should ensure that as many data subjects concerned as possible are reached. Relevant means to make the information publicly available should be determined depending on the context of the research project and the data subjects involved.Amendment
(37) Where the processing takes place for the purpose of scientific research and the provision of information to the data subject proves to be impossible or would involve a disproportionate effort it should not be necessary to provide the information provided for under Article 13 of this Regulation. In such situations the controller should inform data subjects indirectly, such as by making the information publicly available. The provision of such information should ensure that as many data subjects concerned as possible are reached. Relevant means to make the information publicly available should be determined depending on the context of the research project and the data subjects involved.
noyb's comment:
The proposal is more detrimental to the level of data protection than the initial proposal by the Commission. At the same time the level of complexity is further reduced for the controller invoking this exemption.
#369 Recital 38
Authored by
Text proposed by the Commission
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.Amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The requirement to provide “meaningful information about the logic involved” does not oblige controllers to disclose internal algorithms, proprietary logic, or commercially sensitive business knowledge.
noyb's comment:
The proposed exclusion of, inter alia, “commercially sensitive business knowledge” is contrary to CJEU case law which requires a balancing of interest even for information that is more protected than mere business knowledge.
#374 Recital 38 a (new)
Authored by
Text proposed by the Commission
Amendment
(38a) To ensure compliance with the requirements of this Regulation in respect of the processing to be carried out by the processor on behalf of the controller, when entrusting a processor with processing activities, the controller should use only processors providing sufficient guarantees, in particular in terms of expert knowledge, reliability and resources, to implement technical and organisational measures which will meet the requirements of this Regulation, including for the security of processing. The adherence of the processor to an approved code of conduct or an approved certification mechanism may be used as an element to demonstrate compliance with the obligations of the controller. If processing by a processor is governed by an agreement with the controller which specifies the subject matter and duration of the processing, the nature and purpose of the processing, the types of data to be processed and the categories of data subjects the tasks and duties of the processor shall be directly qualified by this Regulation in order to avoid legal uncertainty and provide clear standards for all parties, which process personal data within the scope of European law. Furthermore, if the processor provides a binding assurance as to the level of protection to which it is able to ensure the security of the processing and its obligation to assist the controller by means of appropriate technical and organisational measures and confirms the suitability of these safeguards for the processing operations it intends to carry out, due to the nature of these services as mere digital infrastructure Services their agreements may renounce on some specific notification requirements of controllers. However, processors who fail to fulfil those assurances are directly liable for this non compliance. After the completion of the processing on behalf of the controller, the processor should, at the choice of the controller, return or delete the personal data, unless there is a requirement to store the personal data under Union or Member State law to which the processor is subject.Justification
Article 28 should better reflect modern cloud, hosting, security and infrastructure services, which are standardised, layered and technically complex. For such infrastructure processing, controllers need enforceable assurances on security, assistance and downstream liability, not bespoke descriptions of every technical sub-operation. The amendment cuts formalistic contract burdens while preserving core duties: confidentiality, security, assistance, deletion or return, audits, controller suitability checks and processor liability for sub-processors.
noyb's comment:
This proposal seems to be connected with the direct application of some of the contents of Article 28 for the processor without requiring those aspects to be part of the processing agreement. However, the third sentence is rather unclear when it comes to the “specific notification requirements” and how they are affected by the contract with the processor.
#375 Recital 38 a (new)
Authored by
Text proposed by the Commission
Amendment
(38a) While Article 28 of Regulation 2016/679 establishes a robust framework for contractual accountability, its practical application has created a structural asymmetry when controllers often rely on systemic digital actors designated as gatekeepers under Regulation (EU) 2022/1925. This creates a redundant administrative burden for small and medium-sized enterprises (SMEs), small mid-cap enterprises (SMCs) and public authorities. To eliminate this red tape and enhance digital sovereignty, a direct compliance mechanism should apply solely to gatekeepers by way of derogation from Article 28. Where a processor is a designated gatekeeper, its core data protection duties should come directly from this Regulation. Processors not designated as gatekeepers do not possess equivalent market power and remain entirely subject to the standard contractual framework, preserving contractual freedom and a competitive digital ecosystem.
noyb's comment:
Requiring certain processors (gatekeepers) to directly apply certain provisions would make it easier to enforce those provisions against those actors which would increase the level of data protection since currently, responsibility is often shifted to controllers using the services of those processors even if they factually cannot influence the processing in a manner typical to a controller. Not requiring processors to audit processors would reduce complexity as well.
#392 Recital 40
Authored by
Text proposed by the Commission
(40) Article 35 of that Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. The lists of processing operations should be prepared by the Board and adopted by the Commission as an implementing act. In order to facilitate compliance by controllers, the Board should also prepare a common template and a common methodology for conducting data protection impact assessments, to be adopted by the Commission as an implementing act. The Commission should take due account of the proposals prepared by the Board and review them, as necessary, prior to adoption. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary.Amendment
(40) Article 35 of Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. The lists of processing operations should be prepared by the Board and adopted by the Commission as an implementing act. In order to facilitate compliance by controllers, the Board should also prepare a common template and a common methodology for conducting data protection impact assessments, to be adopted by the Commission as an implementing act. The Commission should take due account of the proposals prepared by the Board and review them, as necessary, prior to adoption. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary.
#394 Recital 40 a (new)
Authored by
Text proposed by the Commission
Amendment
(40a) Regulation (EU) 2016/679 follows a technology-neutral, risk-based and purpose-driven approach to the processing of personal data. The lawfulness of processing should be determined by reference to a specific and legitimate purpose and an assessment of the risks posed to the rights and freedoms of natural persons, taking into account the nature, scope, context and purposes of the processing. Where personal data are processed through the terminal equipment of natural persons, and the available indicators demonstrate that the likelihood and severity of risks to those rights and freedoms are limited, reliance on legal bases other than consent may be justified, where appropriate.
noyb's comment:
Allowing further legal bases for the processing through terminal equipment of natural persons would reduce the level of data protection.
#396 Recital 41
Authored by
Text proposed by the Commission
(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council16 applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council17 applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brough into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. _________________ 16 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). 17 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).Amendment
(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council16 applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council17 applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brough into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. Any alignment brought to Directive (EU) 2016/680 by the amendments to Regulation (EU) 2016/679 shall not override the legitimate national and public security interests of Member States, as well as the legitimate internal security interests of the Union. _________________ 16 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). 17 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).
noyb's comment:
No real direct effect but just accounting for differences in LED and GDPR.
#397 Recital 41
Authored by
Text proposed by the Commission
(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council16 applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council17 applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brough into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. _________________ 16 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). 17 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).Amendment
(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council16 applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council17 applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Where competent authorities within the meaning of Directive (EU) 2016/680 demonstrate that equivalent safeguards are ensured under Union or national law, compliance with corresponding safeguards under this Regulation should be presumed. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brough into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. _________________ 16 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). 17 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).
noyb's comment:
The meaning of this addition is unclear (e.g. what “equivalent safeguards” refer to). Due to the different scope of the legal acts, it is also unclear, how broad any comparison of safeguards should be. However, any presumption of compliance contrary to the principle of accountability could potentially be seen as effectively reducing the level of privacy.
#398 Recital 41
Authored by
Text proposed by the Commission
(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council16 applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council17 applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brough into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. _________________ 16 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). 17 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).Amendment
(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council16 applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council17 applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brought into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. _________________ 16 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). 17 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).
#401 Recital 43
Authored by
Text proposed by the Commission
(43) In order to provide a strong and coherent data protection framework in the Union, the necessary adaptations of Directive (EU) 2016/680 and any other Union legal act applicable to such processing of personal data should follow after the adoption of this regulation, in order to allow for their application as close as possible to the entry into application of the amendments to Regulation (EU) 2016/679 and Regulation (EU) 2018/1725.Amendment
(43) In order to provide a strong and coherent data protection framework in the Union, the necessary adaptations of Directive (EU) 2016/680 and any other Union legal act applicable to such processing of personal data should follow after the adoption of this regulation, in order to allow for their application as close as possible to the entry into application of the amendments to Regulation (EU) 2016/679 and Regulation (EU) 2018/1725. Any following adaption of Directive (EU) 2016/680 should not impair the ability of competent authorities to process personal data collected in the context of the prevention, investigation, detection or prosecution of specific criminal offences in order to develop an understanding of criminal activities and to make links between different criminal offences detected. Moreover, any concurrent adaptation of Regulation (EU) 2018/1725 shall not impair the processing of personal data for the purpose of preventing threats to public security, internal security of Union institutions and bodies, or other important objectives of general public interest of the Union or of a Member State, in particular the objectives of the Common Foreign and Security Policy of the Union or an important economic or financial interest of the Union or of a Member State.
noyb's comment:
This proposal seems to signal that a general superiority of processing related to law enforcement over data protection. In particular regarding the aspects of “understanding of criminal activities and to make links between different criminal offences detected” which might refer to big data analysis based on criminal data, this seems like pushing for a reduction of the level of privacy.
#435 Recital 44 – paragraph 2
Authored by
Text proposed by the Commission
The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment should continue to be allowed only on the basis of consent. Similar to the approach in Directive 2002/58/EC, this requirement should not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, when that is based on Union or Member State law within the meaning of Article 6 of Regulation (EU) 2016/679 and if it fulfils all conditions of lawfulness laid down in that provision, and is done for the objectives laid down in Article 23(1) of Regulation (EU) 2016/679.Amendment
The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment should continue to be allowed only on the basis of consent. Similar to the approach in Directive 2002/58/EC, this requirement should not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, when that is based on Union law within the meaning of Article 6 of Regulation (EU) 2016/679 and if it fulfils all conditions of lawfulness laid down in that provision, and is done for the objectives laid down in Article 23(1) of Regulation (EU) 2016/679.
noyb's comment:
Minimally improves the Commission proposal, but still relies on the devide between personal and non-personal cookies which brings about legal uncertainty.
#439 Recital 44 – paragraph 3
Authored by
Text proposed by the Commission
With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. The controller, such as a media service provider, may mandate a processor, such as a market research company, to carry out the processing on its behalf.Amendment
With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. This list should include measuring the audience of an online service by creating aggregated information about the usage of an online service, where it is carried out by the provider of that online service, or by a third party, such as a market research company or a Joint Industry Committee, acting together with or on behalf of this provider. ‘Audience measurement’ should be understood in accordance with Article 2(16) and with Article 24(1) of Regulation (EU) 2024/1083. Gatekeepers designated under Regulation (EU) 2022/1925 carrying out audience measurement may not rely on article 88a(3)c of this Regulation. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. The controller, such as a media service provider, may mandate a processor, such as a market research company, to carry out the processing on its behalf.
noyb's comment:
Relies on further exceptions to the current legal framework.
#441 Recital 44 – paragraph 3
Authored by
Text proposed by the Commission
With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. The controller, such as a media service provider, may mandate a processor, such as a market research company, to carry out the processing on its behalf.Amendment
With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. The controller, such as an online service or a media service provider, may mandate a processor or joint controller, such as a market research company or Joint Industry Committee, to carry out the processing jointly or on its behalf, subject to strict safeguards ensuring that such processing is proportionate, compliant with the requirements of Article 24(1) of Regulation (EU) 2024/1083 and is not repurposed for advertising, profiling, or other unrelated purposes.Justification
This amendment ensures consistency with Article 5.3(c) of Regulation (EU) 2016/679 by clarifying that audience measurement may be conducted by mandated joint controllers, including Joint Industry Committees and research companies. It aligns the recital with the EMFA framework, strengthening legal certainty, independent measurement and safeguards against profiling or advertising purposes.
noyb's comment:
Relies on further exceptions to the current legal framework.
#467 Recital 46
Authored by
Text proposed by the Commission
(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser or in the EU Digital Identity Wallet as set out by Regulation (EU) 914/2014, or any other adequate means. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, media service providers should not be obliged to respect the machine-readable indications of data subject’s choices. The obligation for providers of web browsers to provide the technical means for data subjects to make choices with respect to the processing should not undermine the possibility for media service providers to request consent by data subjects.Amendment
(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser or in the EU Digital Identity Wallet as set out by Regulation (EU) 914/2014, or any other adequate means. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, media service providers should not be obliged to respect the machine-readable indications of data subject’s choices. The obligation for providers of web browsers to provide the technical means for data subjects to make choices with respect to the processing should not undermine the possibility for media service providers to request consent by data subjects. To support media sustainability in Europe, Media Service Providers can ask for consent or establish necessary conditions for other legal bases for third parties as long as that is done for data processing required to support the functioning or funding of Media Service Providers and is conducted exclusively on their properties.
noyb's comment:
Goes back beyond the Commission proposal. Tries to grant legislative powers to Media Service Providers?!
#489 Recital 48 a (new)
Authored by
Text proposed by the Commission
Amendment
(48a) The free movement of personal data within the Union and the protection of natural persons are objectives of equal rank of this Regulation. Where a provision of this Regulation is open to more than one interpretation in respect of processing privileged under Article 10a, preference is to be given to the interpretation that gives effect to both objectives. The privilege rests on an exchange: the controller or processor obtains a presumption of compliance and relief from documentation duties, and in return makes data available for objectives of general interest; that exchange establishes, in the assessment under Article 52(1) of the Charter, the proportionality of the privilege as a whole. The extent of the data to be made available should be proportionate to the nature and scale of the processing and to the size and capacity of the controller or processor. Standards applied in the market, including international standards, may afford safeguards equivalent to those of approved codes of conduct and certification mechanisms; the Board should include a standard in its list where compliance with the standard is independently verifiable and monitored and where its safeguards afford an equivalent level of protection, and should remove it where those conditions cease to be met. The ordinary commercial activities of a micro, small or medium-sized enterprise do not include the making available of personal data against remuneration as its principal activity. Article 10a provides a basis in Union law for the purposes of points (g) and (j) of Article 9(2); whether the processing is necessary remains to be assessed in the individual case, and the essence of the right to data protection is to be respected in every application of the Article. Specific and substantiated indications require concrete elements relating to the processing in question; the assertion of an infringement does not suffice, and full proof is not required. Standardised information fulfils the purpose of Articles 13 and 14 where it enables data subjects to identify the controller, understand the purposes of the processing and exercise their rights. For transfers to third countries, the presumption leaves intact the requirement that data subjects enjoy a level of protection essentially equivalent to that guaranteed within the Union. The rights of data subjects do not depend on the commitment; its withdrawal ends the privilege for the future and leaves obligations already incurred unaffected. The powers of supervisory authorities and the rights and remedies of data subjects shall remain unaffected.Justification
This amendment creates an incentive model for data use serving general-interest objectives, such as intra-group administration, SME operations, research, archiving and statistics. Privileged status is limited to actors that make a data-sharing commitment and follow recognised safeguards, including codes, certification, BCRs or listed standards. The rebuttable presumption rewards accountable governance without lowering protection, excludes gatekeepers and VLOPs/VLOSEs, and covers high-risk processing only after a DPIA.
noyb's comment:
Privileging processing for certain commercial purposes while presuming their compliance reduces the level of data protection. The assumed compliance and the reduced documentation duties might provide for less complexity for some controllers.
#923 Article 2 – paragraph 4a (Article 3 – paragraph -1 (new))
Authored by
Regulation (EU) 2016/679
Article 2 – paragraph 4a
Present text
No equivalentAmendment
-1 Article 2 is amended by adding the following paragraph: "4a. Articles [19, 20, 27, 30, 35 to 39] of this Regulation do not apply to small controllers."Justification
RISK-BASED APPROACH #4: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
The reducing of scope of the GDPR reduces complaince obligations for small controllers, but protection for data subjects.
#924 Article 2 – paragraph 2 (Article 3 – paragraph -1 a (new))
Authored by
Regulation (EU) 2016/679
Article 2 – paragraph 2
Present text
2. This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity; (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public securityAmendment
-1 a In Article 2, four new points are added to paragraph 2: "2. This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity; (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; (da) by natural or legal persons for non-professional or non-commercial purposes; (db) in the course of an activity that is likely to result in a low risk to the rights and freedoms of natural persons; (dc) by micro, small and medium-sized enterprises; (dd) which is of a purely incidental or transitory nature and is carried out for a purpose unrelated to the data subject as an identified or identifiable natural person."Justification
SCOPE EXCLUSION #1: This amendment offers an alternative to the proposed risk-based simplification package by excluding non-commercial, low-risk, SME and purely incidental processing from the GDPR’s full scope. It does not deregulate such processing: Member States must ensure protection through other suitable laws, including private-life, contract, consumer, labour, tort, unfair-competition and criminal law. This reduces disproportionate administrative burdens, supports data flows and focuses GDPR enforcement on processing that creates real risks for individuals.
noyb's comment:
The amendment significantly reduces the scope of the application of the GDPR and thus reducing compliance burdens, but at the same time significantly reduces protections of data subjects.
#926 Article 2 – paragraph 4 (new) (Article 3 – paragraph 1 – point -1 (new))
Authored by
Regulation (EU) 2016/679
Article 2 – paragraph 4 (new)
Present text
No equivalentAmendment
– In Article 2, a new paragraph is added after paragraph 4: "4a. Member States shall ensure that the processing of personal data that is exempted from the scope of this Regulation pursuant to paragraphs […] is subject to the obligations of other laws than data protection law, including legislation on the protection of private and family life, contract law, tort law, unfair competition law, consumer law, labor law and criminal law. These other laws shall meet objectives of general interest, especially the free flow of data, and, subject to the principle of proportionality, strike a fair balance between all persons involved in or affected by the data processing."Justification
SCOPE EXCLUSION #2: This amendment offers an alternative to the proposed risk-based simplification package by excluding non-commercial, low-risk, SME and purely incidental processing from the GDPR’s full scope. It does not deregulate such processing: Member States must ensure protection through other suitable laws, including private-life, contract, consumer, labour, tort, unfair-competition and criminal law. This reduces disproportionate administrative burdens, supports data flows and focuses GDPR enforcement on processing that creates real risks for individuals.
noyb's comment:
This change would reduce protection of data subjecs because of excluding certain processing from the GDPR while at the same time signficantly increasing legal uncertainty and inconsistency by requiring that data protection will be inserted into other EU law.
#937 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – second part
Text proposed by the Commission
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’Amendment
Information relating to a natural person does not necessarily constitute personal data for every person or entity, merely because another person or entity can identify that natural person. Whether or not information constitutes personal data should be assessed on a case-by-case basis, with regard to each person or entity that holds or receives that information, taking into account all means reasonably likely to be used by that person or entity to identify the natural person concerned, including the costs, time required and available technology. Information shall not be personal for a given person or entity where that person or entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used. Depending on the circumstances, pseudonymisation may prevent a person or entity other than the controller from identifying the data subject, such that, for that person or entity, the data subject is not, or is no longer, identifiable. That does not affect the classification of that information as personal data for the controller, nor its obligations under Articles 13 and 14.
noyb's comment:
The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1) and violates Article 8 of the CFR.
#940 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – second part
Text proposed by the Commission
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.Amendment
Information relating to a natural person, depending on the circumstances of the case, is not necessarily personal data for every other person or entity, in so far as that person or entity cannot identify that natural person to whom the information relates taking into account the means reasonably likely to be used by that person or entity, Information relating to a natural person is, however, personal data where this information is likely to be put or is put at the disposal of other persons or entities who have the means reasonably likely to enable the data subject to be identified.
noyb's comment:
The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1).
#941 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – second part
Text proposed by the Commission
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.Amendment
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. The means reasonably likely to be used by a specific entity shall be assessed in the light of that entity's actual technical capabilities, having regard to the ressources, costs, available technical means and time required for identification, rather than hypothetical possibilities.
noyb's comment:
The amendment includes more derogations than the Commission's proposal.
#943 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – second part
Text proposed by the Commission
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.Amendment
Information relating to a natural person, is not personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. That assessment shall take into account objective factors, including but not limited to costs, time, available technology and the legal means available to that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.
noyb's comment:
The amendment does not materially change the Commission's proposal, thus overall remains a decrease of protection compared to the current Article 4(1).
#946 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – second part
Text proposed by the Commission
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.Amendment
Regulation (EU) 2016/679 shall not apply to the processing of personal data, including sensitive personal data, where: (a) the processing is merely transitory in nature; and (b) the processing is for a purpose that is unrelated to the data subject as an identified or identifiable natural person; and (c) appropriate technical and/or organisational safeguards are in place to prevent any use of the data for a purpose related to the data subject as an identified or identifiable natural person up to the point when the data are irreversibly anonymised or erased.
noyb's comment:
The amendment includes more derogations than the Commission's proposal.
#947 Article 4 – point 1 – third part (new) (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – third part (new)
Text proposed by the Commission
Amendment
In Article 4, point 1, the following part is added: 'Data shall not be considered as personal data within the meaning of Regulation (EU) 2016/679 and other Union and national law referring to or relying on the notion of personal data within the meaning of Regulation (EU) 2016/679 insofar as: (a) the data relate primarily to an entity other than a natural person, such as an enterprise or an object, and the data subject is associated with that entity exclusively as owner, employee or in a similar function; and (b) processing of the data is for a purpose that is not specifically related to the data subject as an identified or identifiable natural person; and (c) appropriate technical and/or organisational safeguards are in place to prevent any use of the data for a purpose specifically related to the data subject as an identified or identifiable natural person.'
noyb's comment:
The amendment includes more derogations than the Commission's proposal.
#948 Article 4 – point 15 (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 15
Text proposed by the Commission
Amendment
(15) ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status; Data that merely allow such information to be inferred indirectly shall not be considered data concerning health;
noyb's comment:
Lowering the protections for health data (e.g. person buying HIV medicine would not be covered anymore under Article 9 because the person could buy it for someone else).
#953 Article 4 – point 33 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 33
Text proposed by the Commission
(33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply;Amendment
(33) electronic communications networks’ means transmission systems as defined in of Article 2(1) of Directive (EU) 2018/1972;
#964 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38
Text proposed by the Commission
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.Amendment
(38) “scientific research” means any research which can also support innovation, such as technological development, demonstration, applied research and privately funded research. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude research testing or development of AI systems or AI models prior to their being placed on the market or put into service or the aim to further a commercial interest.
noyb's comment:
Can be read to presume that AI system development is scientific research
#966 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38
Text proposed by the Commission
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.Amendment
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude the research testing or development activity regarding AI systems or AI models prior to their being placed on the market or put into service or the aim to further a commercial interest.
noyb's comment:
Can be read to presume that AI system development is scientific research
#970 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38
Text proposed by the Commission
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.Amendment
(38) “scientific research” means creative and systematic work undertaken in order to increase the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts without any particular application or use in view, or through original investigation undertaken in order to acquire new knowledge directed primarily towards a specific, practical aim or objective. This does not exclude that the research may also aim to further a commercial interest.
noyb's comment:
Wider scope than current understanding. Mainly formal criteria. Not overly clear.
#971 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38
Text proposed by the Commission
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.Amendment
(38) “scientific research” means creative and systematic work undertaken in order to increase the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts without any particular application or use in view, or through original investigation undertaken in order to acquire new knowledge directed primarily towards a specific, practical aim or objective. This does not exclude that the research may also aim to further a commercial interest.
#975 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38
Text proposed by the Commission
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.Amendment
(38) “scientific research” means any research activity including technological development demonstration, fundamental research, applied research and privately funded research. These actions shall contribute to existing scientific knowledge, apply to existing knowledge in novel ways, or be carried out with the aim of contributing to the growth of society´s general knowledge or wellbeing. This does not exclude that the research may also aim to further a commercial interest.Justification
Scientific research should be defined by its purpose, methodology and contribution to knowledge, not by whether it is carried out by academia, public bodies or companies. The amendment codifies the broad approach already reflected in GDPR Recital 159, covering technological development, demonstration, fundamental, applied and privately funded research. Commercial interest alone should not exclude genuine research from the GDPR research framework or Article 89 safeguards.
#976 Article 4 – point 38a (new) (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38a (new)
Text proposed by the Commission
Amendment
(38a) ‘small controller’ means any controller, if: (a) the processing of personal data is not a core business activity of the controller, (b) does not process special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10 as part of another core business activity of the controller, a department or branch of the controller and (c) the controller processes personal data of less than [100 000] data subjects in the pending or preceding financial year.Justification
RISK-BASED APPROACH #5: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
#981 Article 4 – point 38b (new) (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38b (new)
Text proposed by the Commission
Amendment
(38b) ‘large controller’ means a controller, if: (a) it processed personal data of more than [50 000 000] or more than [33]% of the population of any given Member State in the pending or preceding financial year, or (b) if it was designated a gatekeeper under Article 3 of Regulation (EU) 2022/1925 or a very large online platform or very large online search engine under Article 33 of Regulation (EU) 2022/2065.Justification
RISK-BASED APPROACH #6: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
#987 Article 4 – point 38c (new) (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38c (new)
Text proposed by the Commission
Amendment
(38c) ‘medium controller’ means any controller that is not a small controller or large controller.Justification
RISK-BASED APPROACH #7: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
#1001 Article 5 – paragraph 2a (new) (Article 3 – paragraph 1 – point 2 a (new))
Authored by
Regulation (EU) 2016/679
Article 5 – paragraph 2a (new)
Present text
No equivalentAmendment
2a. In Article 5, the following paragraph is added: "2a. The principles of this Regulation relating to the protection of personal data shall be interpreted in such a way that the requirements of this Regulation are proportionate to the purpose for which they are intended and, in particular, take into account the varying likelihood and severity of the risk that data processing poses to the rights and freedoms of natural persons (risk-based approach). Measures taken to protect personal data must strike a fair balance with the interests or fundamental rights and freedoms of persons other than the data subject."Justification
INNOVATION PACKAGE #1: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
The amendment includes a proportionality test for the core GDPR principles, a balancing test which could go further than Article 52 of the Charter and general risk-based approach which takes into account the likelihood of a risk. It leads to a generalized decrease of protection.
#1003 Article 5 – paragraph 3a (new) (Article 3 – paragraph 1 – point 2 a (new))
Authored by
Regulation (EU) 2026/679
Article 5 – paragraph 3a (new)
Text proposed by the Commission
Amendment
2a. In Article 5, the following paragraph 3 is added: '3a. The principles and obligations laid down in this Regulation shall be applied and interpreted in a manner that is commensurate with the objective pursued by the provision concerned, that restricts the free movement of personal data no further than is necessary, and that gives due weight to the interests and to the fundamental rights and freedoms of persons other than the data subject.'
noyb's comment:
The amendment includes a balancing test in favour of less privacy.
#1008 Article 6 – paragraph 4 – subparagraph (new) (Article 3 – paragraph 1 – point 2 b (new))
Authored by
Regulation (EU) 2016/679
Article 6 – paragraph 4 – subparagraph (new)
Text proposed by the Commission
Amendment
2b. In Article 6, paragraph 4, the following sentence is added: 'Where the intended further processing is compatible with the purposes for which the personal data were initially collected, it may rest on the legal basis that justified their collection; a separate legal basis shall not be required.'
noyb's comment:
Violates the need for a legal basis in Article 8(2) of the Charter. Consent for one purpose could be used for secondard processing for another purpose.
#1009 Article 5 – paragraph 2 (Article 3 – paragraph 1 – point 2 b (new))
Authored by
Regulation (EU) 2016/679
Article 5 – paragraph 2
Present text
2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).Amendment
2b. In Article 5, paragraph 2 is amended: "2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). When assessing compliance with the accountability obligation, appropriate governance structures, in particular, the appointment of a data protection officer in accordance with Article 37, shall be taken into account."Justification
DPO Package #1: The amendment strengthens accountability by recognising DPOs as practical governance safeguards and first points of contact for complaints. DPOs already advise controllers and processors, monitor compliance and support data subjects; giving them an explicit complaint-handling role makes resolution faster, less bureaucratic and closer to the facts. Voluntary or shared DPOs are encouraged. Supervisory authorities remain available where the complaint is not addressed or not fully remedied within one month.
noyb's comment:
Seems to support voluntary DPO appointments. Unclear how this would link to the duties in Article 5(2).
#1012 Article 6 – paragraph 1 – point f –subparagraph (Article 3 – paragraph 1 – point 2 c (new))
Authored by
Regulation (EU) 2016/679
Article 6 – paragraph 1 – point f –subparagraph
Present text
No equivalentAmendment
2c. Article 6, paragraph 1, point f, including the second subparagraph, is amended as follows: "(fa) processing is necessary for the anonymisation of personal data and that processing serves the principles of data minimisation or storage limitation. (2nd sub-paragaph) For the purposes of point f, controllers that are part of a group of undertakings within the meaning of Article 4, point 19, or institutions affiliated to a central body, shall be presumed to have a legitimate interest in transmitting personal data within that group or between such affiliated institutions for clearly defined internal administrative purposes, including central human resources management, financial and accounting administration, compliance monitoring, IT and cybersecurity management, internal audit, risk management and group reporting, provided that the processing is necessary and proportionate for those purposes and subject to appropriate technical and organisational safeguards. This presumption shall not affect the rights and freedoms of the data subject, including the right to object under Article 21, the processing of special categories of personal data under Article 9, the processing of personal data relating to criminal convictions and offences under Article 10, or the rules on transfers of personal data to third countries or international organisations under Chapter V. An illustrative list of legitimate interests within the meaning of point f of the first subparagraph is included in Annex II; the Commission is empowered to adopt delegated acts to amend Annex II by adding, deleting or modifying use-cases of legitimate interests, after having consulted the Board referred to in Article 68. Point f of the first subparagraph shall not apply to processing carried out by public authorities where they act in performance of sovereign powers."Justification
The package makes Article 6 more predictable by clarifying that anonymisation may require a lawful processing step, recognising safeguarded intra-group administrative transfers, and adding a non-exhaustive Annex of legitimate-interest use cases. This supports consistent application across the Union without creating a blanket permission: necessity, proportionality and the balancing test remain required, especially for children. Commission updates after EDPB consultation keep the framework adaptable to new technologies and business practices. (see ANNEX 1a)
noyb's comment:
The amendment includes a derogation in relation to Article 6(1)(f) which is not foreseen in the current regime.
#1014 Article 5 – paragraph 1– point c (Article 3 – paragraph 1 – point 2 d (new))
Authored by
Regulation (EU) 2016/679
Article 5 – paragraph 1– point c
Present text
1. Personal data shall be:Amendment
2d. Article 5, paragraph 1, point c is deleted: "1. Personal data shall be:"
#1025 Article 9 – paragraph 2 – point k (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k
Text proposed by the Commission
(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.Amendment
(k) incidental and residual processing in the context of the development, training, testing, deployment and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model as referred to in Regulation (EU) 2024/1689, including for the improvement of such systems or models and of related products or services, subject to the conditions referred to in paragraph 5.
noyb's comment:
This amendment proposes to add the terms incidental and residual to the article but adds the improvement of models or services in the proposed provision.
#1027 Article 9 – paragraph 2 – point k (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k
Text proposed by the Commission
(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.Amendment
(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or a GPAI model, subject to the conditions referred to in paragraph 5.Justification
The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.
#1031 Article 9 – paragraph 2 – point l (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point l
Text proposed by the Commission
(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.Amendment
(l) processing of biometric data is authorised when it is used to confirm the identity of a data subject (verification), provided that the biometric data or the means needed for that verification remain under the sole control of the data subject. Where biometric verification is part of an access control process within strategic public transport infrastructure, the storage of biometric data and the means necessary for verification may be under the exclusive control of the controller, provided that such processing is strictly necessary and proportionate, ensures a high level of security, including robust encryption, strict access controls and protection against cyberattacks, and fully respects the fundamental rights and freedoms of the data subjects concerned.
noyb's comment:
The amendment supports and goes further than the Commission's proposal that already decreases protection compared to the current Article 9.
#1036 Article 9 – paragraph 2 – point l (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point l
Text proposed by the Commission
(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.Amendment
(l) processing of biometric data for the purposes of uniquely identifying a natural person provided that the use of biometric data is not mandatory, that a non-biometric alternative of comparable effectiveness is available to the data subject and that appropriate safeguards are applied to protect the fundamental rights and interests of the data subject.Justification
The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.
noyb's comment:
The amendment improves the Commission's proposal to a point where data subjects are almost as protected as in the current regime.
#1039 Article 9 – paragraph 2 – point la (new) (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point la (new)
Text proposed by the Commission
Amendment
(la) processing is necessary for the development, testing, validation, deployment or improvement of technologies directly or indirectly serving an important public-benefit purpose, provided that: (i) the processing does not pursue a direct identification of data subjects and a direct allocation of special categories of personal data to an individual person; (ii) the controller does not take decisions producing legal effects or similarly significant effects concerning identified natural persons on the basis of such processing; (iii) the processing is limited to what is necessary for the relevant public-benefit purpose; and (iv) appropriate technical and organisational safeguards are applied, including data minimisation, access restrictions and, where feasible, pseudonymisation or anonymisation.Justification
The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.
noyb's comment:
The amendment includes massive additional derogations than the Commission's proposal. Uncelar wording does not seem to simplify matters.
#1040 Article 9 – paragraph 2 – point la (new) (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point la (new)
Text proposed by the Commission
Amendment
(la) processing is strictly necessary for the recognition, management or payment of retirement, disability, dependency or other related pension benefits, where such processing is required by contract or legal provision governing the pension plan, for the sole purpose of verifying and administering the conditions for entitlement, and is subject to appropriate and specific safeguards to protect the fundamental rights and interests of the data subject, including data minimisation, purpose limitation, restricted access and professional secrecy. This provision shall not affect the validity of other legal bases currently relied upon under this Regulation for the processing of health data related to the treatment of certain pension benefits.
noyb's comment:
The amendment includes more derogations than the Commission's proposal.
#1041 Article 9 – paragraph 2 – point la (new) (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point la (new)
Text proposed by the Commission
Amendment
(la) In Article 9, paragraph 2, the following point is inserted: '(la) processing is necessary for the purpose of scientific research by a recognised organisation that is subject to a Data Protection Impact Assessment, a recognised ethics committee, appropriate technical and organisational measures including pseudonymisation and public registration.'
noyb's comment:
The amendment includes more derogations than the Commission's proposal and subjects the processing to additional formalities.
#1042 Article 9 – paragraph 2 – point la (new) (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point la (new)
Text proposed by the Commission
Amendment
(la) In Article 9, paragraph 2, the following point is inserted. the other points should be adapted accordingly. '(la) the processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of precontractual measures taken at the data subject’s request;'
noyb's comment:
The amendment includes more derogations than the Commission's proposal.
#1043 Article 9 – paragraph 2 – point lb (new) (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point lb (new)
Text proposed by the Commission
Amendment
(lb) In Article 9, paragraph 2, the following point is added: 'lb. processing is necessary and proportionate for the prevention of fraud, the detection and prevention of abuse, bot and spam activity, identity misuse, account takeover or payment fraud, or for ensuring the security of accounts, payments and transactions, provided that the processing is subject to appropriate safeguards for the rights and freedoms of the data subject.'
noyb's comment:
The amendment includes more derogations than the Commission's proposal. Uncelar why Article 9 data would be necessary for these purposes.
#1044 Article 9 – paragraph 2 – point lb (new) (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point lb (new)
Text proposed by the Commission
Amendment
(lb) in Article 9, paragraph 2, the following point is added: 'lb. processing is necessary for the purposes of carrying out obligations set by other Union law, without cross-references to Regulation (EU) 2016/679.'
noyb's comment:
No relevant change compared to Article 9(2)(g) GDPR. Any such law must be "proportinate" under Article 8 and 2 of the Charter.
#1045 Article 9 – paragraph 1 (Article 3 – paragraph 1 – point 3 – point a a (new))
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 1
Text proposed by the Commission
Amendment
(aa) Paragraph 1 of Article 9 is replaced by the following: Processing of personal data that directly reveals in relation to a specific data subject racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health relating to the physical or mental health status of a natural person, or data concerning a natural person's sex life or sexual orientation shall be prohibited.
noyb's comment:
Limitation of scope of Article 9 to information that only "directly" reveals such data.
#1055 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 5
Text proposed by the Commission
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Amendment
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid and mitigate the risk of the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the is notified of or identifies special categories of personal data relating to specific data subjects in the aforementioned datasets used for training, testing or validation or in the AI system or AI model, the controller shall implement technically and economically feasible measures to cease processing of those special categories of personal data for the purpose of training or developing an AI system or AI model. If cessation of processing requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Justification
This amendment makes Article 9(5) more practical by replacing the obligation to "avoid" processing special categories of personal data with a proportionate duty to mitigate risks through appropriate technical and organisational measures. It clarifies that controllers must act when such data is identified or reported, and, where deletion is disproportionate, apply technically and economically feasible safeguards. The amendment preserves strong data protection while ensuring legal certainty and practical implementation.
noyb's comment:
The amendment proposes for the controllers only to implement economically feasible measures, thereby proposing a more relaxed approach than the Commission's proposal.
#1056 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 5
Text proposed by the Commission
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Amendment
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data.Justification
The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.
noyb's comment:
This amendment goes further than the COM proposal in providing a bigger allowance than the proposed Article 9(5).
#1057 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 5
Text proposed by the Commission
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Amendment
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented, in accordance with Article 89 safeguards to limit the processing of special categories of personal data and to mitigate the risk associated with the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall ensure that such data are processed under one or more of the conditions referred to in paragraph 2, points a to j, or remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’
noyb's comment:
The amendment proposes to have a "fall-back" Article 9(2) legal basis for residual special categories of personal data which is a wider allowance than initially proposed by the Commission.
#1059 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 5
Text proposed by the Commission
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Amendment
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to mitigate the risk of collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller is notified of special categories of personal data relating to specific data subjects in the aforementioned datasets used for training, testing or validation or in the AI system or AI model, the controller shall, taking into account its capabilities, implement appropriate technical and organisational measures to cease processing that special category data for the purpose of training or developing an AI system or AI model.
noyb's comment:
The amendment is a mixed attempt to increase protection with stronger wording, but without actual enforcement options or specific technical measures. Generally accepts the COM proposal.
#1061 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 5
Text proposed by the Commission
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Amendment
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data that are incidentally and residually involved in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data without undue delay. If removal of those data requires manifestly disproportionate effort, the controller shall without undue delay and in any event, effectively protect such data from being further processed or processed for other purposes, used to produce outputs, being disclosed or otherwise made available to third parties.
noyb's comment:
Improvement versus COM proposal, but overall still more permissive than current GDPR.
#1062 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 5
Text proposed by the Commission
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Amendment
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to mitigate risks associated with the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being disclosed or otherwise made available to third parties.
noyb's comment:
The amendment does not include any new substantive element.
#1069 Article 12 – paragraph 3 (Article 3 – paragraph 1 – point 3 a (new))
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 3
Text proposed by the Commission
Amendment
3a. in Article 12, paragraph 3 is replaced by the following: '3. The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension without undue delay and in any event within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic means, the information shall be provided by electronic means unless impossible despite the controller’s continuous efforts, unless otherwise requested by the data subject.'
noyb's comment:
Limitation on the right to get a response via electornic means.
#1070 Article 9 – paragraph 1 (Article 3 – paragraph 1 – point 3 a (new))
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 1
Present text
1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.Amendment
3a. In Article 9, paragraph 1 is replaced by the following: "1. Processing of personal data that is intended to directly reveal, in relation to an identified or identifiable natural person, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health status, sex life or sexual orientation, and the processing of genetic data or biometric data for the purpose of uniquely identifying a natural person, shall be prohibited unless one of the conditions set out in paragraph 2 applies. The mere possibility that one of the characteristics referred to in the first subparagraph may be inferred indirectly from personal data processed for another lawful purpose shall not, in itself, render such processing subject to this Article, provided that the controller does not process the data for the purpose of revealing such characteristic."Justification
The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.
noyb's comment:
This proposal intends to limit the essence of the right to the protection of personal data, specifically for special categories of personal data by limiting their protection to only "directly" identified/identifiable persons.
#1071 Article 9 – paragraph 1 (Article 3 – paragraph 1 – point 3 a (new))
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 1
Present text
Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.Amendment
"Processing of personal data directly revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited."
noyb's comment:
This proposal undermines the current level of protection of the GDPR while violating Articles 8 and 52 CFREU.
#1072 Article 9 – paragraph 2a (new) (Article 3 – paragraph 1 – point 3 b (new))
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2a (new)
Present text
No equivalentAmendment
3b. In Article 9, the following paragraphs are added: "2a. For the purposes of paragraph 2, point (la), important public-benefit purposes shall include in particular: (a) the protection of life, health and physical integrity; (b) road safety, accident prevention and transport safety; (c) prevention of criminal offenses; (d) anti-discrimination and foster inclusion and participation of all persons on an equal basis; (e) cybersecurity, including the resilience of connected products, transport and traffic systems and critical infrastructure; (f) scientific research and technological development contributing to the purposes referred to in points (a) to (e). 2b. Processing pursuant to paragraph 2, point (la), shall not be used for the purpose of identifying natural persons, monitoring individual behaviour for unrelated purposes, or taking decisions concerning identified natural persons, unless another legal basis under this Regulation applies."Justification
The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.
noyb's comment:
The amendment is not clear in its scope, and the way it fits into existing Article 9 GDPR. A limitation on the use of sensitive personal data should first comply with Article 52 Charter.
#1073 Article 10a (new) (Article 3 – paragraph 1 – point 3 c (new))
Authored by
Regulation (EU) 2016/679
Article 10a (new)
Present text
No equivalentAmendment
3c. After Article 10, a new Article is added: "Article 10a Privileged processing of personal data 1. The following processing serves objectives of general interest recognised by the Union and may be privileged in accordance with this Article ('privileged processing'): (a) processing necessary for internal administrative purposes within a group of undertakings, including the processing of personal data of clients and employees; (b) processing by a micro, small or medium-sized enterprise within the meaning of the Annex to Recommendation 2003/361/EC, necessary for its ordinary commercial activities; (c) processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), whether or not it constitutes further processing within the meaning of point (b) of Article 5(1). 2. Processing referred to in paragraph 1 shall be privileged where the controller or processor: (a) has committed, by entry in the register referred to in [the Data Act/ Data Governance Act], to making data available for objectives of general interest; and (b) carries out the processing in demonstrable conformity with an approved code of conduct pursuant to Article 40, an approved certification mechanism pursuant to Article 42, binding corporate rules approved pursuant to Article 47, or a standard included in the list established by the Board pursuant to Article 70 point (o). 3. Privileged processing pursues legitimate interests within the meaning of point (f) of Article 6(1). Where it concerns special categories of personal data and is necessary for the objectives referred to in paragraph 1, this Article constitutes a substantial public interest of Article 9(2)(g), (j). Privileged processing shall be presumed to comply with the requirements of this Regulation to which the safeguards give effect, including point (f) of Article 6(1), points (g) (j) of Article 9(2) and, where the controller or processor has assessed and documented that the law and practice of the third country do not impair the effectiveness of the safeguards, Article 46(1). The presumption shall be rebutted by specific and substantiated indications of non-compliance; in that event, the controller or processor shall demonstrate compliance in accordance with Article 5(2). 4. The obligations under Articles 13 and 14 may be fulfilled by providing the standardised information laid down in the instrument referred to in point (b) of paragraph 2. 5. Data made available under the commitment shall not be provided to undertakings referred to in point (b) of paragraph 6. The commitment may be withdrawn with effect for the future; upon withdrawal, the processing ceases to be privileged. The Commission shall adopt delegated acts in accordance with Article 92 specifying the categories of data to be made available, the conditions and modalities of making them available, and the safeguards for the protection of personal data and trade secrets. 6. This Article shall not apply to: (a) processing likely to result in a high risk within the meaning of Article 35, unless a data protection impact assessment has been carried out and its results have been implemented; (b) processing by an undertaking designated pursuant to Article 3 of Regulation (EU) 2022/1925 or Article 33(4) of Regulation (EU) 2022/2065, or by an undertaking belonging to the same group of undertakings."Justification
This amendment creates an incentive model for data use serving general-interest objectives, such as intra-group administration, SME operations, research, archiving and statistics. Privileged status is limited to actors that make a data-sharing commitment and follow recognised safeguards, including codes, certification, BCRs or listed standards. The rebuttable presumption rewards accountable governance without lowering protection, excludes gatekeepers and VLOPs/VLOSEs, and covers high-risk processing only after a DPIA.
noyb's comment:
This amendment proposes a limitation to the protection of both personal data and sensitive personal data by introducing a new legal basis which does not simplify the obligations of SME's.
#1089 Article 12 – paragraph 5 – last subparagraph (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5 – last subparagraph
Text proposed by the Commission
The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.Amendment
deleted
noyb's comment:
The amendment removes the burden of proof of controllers, it goes further than the Commission's proposal.
#1090 Article 12 – paragraph 5 – last subparagraph (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5 – last subparagraph
Text proposed by the Commission
The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.Amendment
deleted
noyb's comment:
The amendment removes the burden of proof of controllers, it goes further than the Commission's proposal.
#1091 Article 12 – paragraph 5 – last subparagraph (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5 – last subparagraph
Text proposed by the Commission
The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.Amendment
deleted
noyb's comment:
The amendment removes the burden of proof of controllers, it goes further than the Commission's proposal.
#1092 Article 12 – paragraph 5 – last subparagraph (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5 – last subparagraph
Text proposed by the Commission
The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.Amendment
deleted
noyb's comment:
The amendment removes the burden of proof of controllers, it goes further than the Commission's proposal.
#1095 Article 12 – paragraph 5 – last subparagraph (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5 – last subparagraph
Text proposed by the Commission
The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.Amendment
For the purpose of assessing whether a request is manifestly unfounded or excessive, the controller may ask the data subject to indicate the exact scope of the request and the specific reasons for the request.
#1096 Article 12 – paragraph 5 – last subparagraph (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5 – last subparagraph
Text proposed by the Commission
Amendment
In Article 12, paragraph 5, the following subparagraph is added: 'The Commission may adopt implementing acts to further specify criteria for what constitutes a manifestly unfounded or excessive character of the request.'
noyb's comment:
The amendment puts the Commission in the position to impair the scope of the right to access and to apply the GDPR, which is reserved to DPAs under Article 8(3) of the Charter.
#1098 Article 12 – paragraph 8a (new) (Article 3 – paragraph 1 – point 4 a (new))
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 8a (new)
Text proposed by the Commission
Amendment
4a. In Article 12, the following paragraph 8a is added: '8a. Where the controller is a SME, the obligations arising under this Chapter and the documentation duties connected with them shall apply in a manner proportionate to the size of the enterprise, the nature of the processing and the risk it presents for data subjects. The Board shall issue guidelines setting out simplified means of compliance for such enterprises.'
noyb's comment:
The amendment restricts all obligation under chapter 3 for SMEs (99% of all EU businesses), which could be beneficial for documentation duties but could restrict data subject rights. SMEs can include large data brokers and alike. The actual meaning of this provision is unclear, hence the simplification is unclear.
#1106 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)
Regulation (EU) 2016/679
Article 13 – paragraph 4
Text proposed by the Commission
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.Amendment
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, or where the provision of such information proves impossible or would involve a disproportionate effort, taking into account the nature, scope, context and purposes of the processing, the size and resources of the controller, and the risk to the rights and freedoms of natural persons, unless the controller transmits the data to other recipients or categories of recipients for purposes other than those directly related to the clear and circumscribed relationship with the data subject, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35. In such cases, the controller shall take appropriate measures to protect the rights and freedoms and legitimate interests of the data subject, including, where appropriate, making the information publicly available in an easily accessible form.Justification
Information obligations are essential for transparency, but they should remain proportionate and workable in low-risk situations. The Commission proposal rightly introduces an exemption for clear and circumscribed relationships where the controller does not carry out data-intensive activities. However, the exemption should also cover situations where individual information proves impossible or would involve a disproportionate effort, provided that appropriate safeguards are maintained. In addition, the mere transmission of data to recipients should not automatically exclude the exemption where such transmission is directly related to the existing relationship with the data subject, for example in the context of associations, non-profit organisations, craft businesses or small enterprises. This amendment preserves transparency while reducing unnecessary administrative burdens.
noyb's comment:
Building upon the Commission’s proposal, this amendment similarly allows for further cases where no information to data subjects is provided (and goes even further). As does the Com proposal, this provision is overly complex and almost unworkable in practise. A lack of information typcially violates the "fairness" principle in Article 8(2) of the Charter.
#1110 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 4
Text proposed by the Commission
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.Amendment
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.
noyb's comment:
This proposal builds on the Commission's proposal but deletes one of the safeguards. Compared to the current version, this proposal still provides for more complexity and legal uncertainty. A lack of information typcially violates the "fairness" principle in Article 8(2) of the Charter.
#1111 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 4
Text proposed by the Commission
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.Amendment
4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information or where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not a high risk to the data subject and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.
noyb's comment:
Small amendments to the Commission's proposal. Mainly clarifying that the proposal provides for an additional exemption. A lack of information typcially violates the "fairness" principle in Article 8(2) of the Charter.
#1112 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)
Authored by
Regulation (EU) 2026/679
Article 13 – paragraph 4
Text proposed by the Commission
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.Amendment
4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information or where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.’
noyb's comment:
Small amendments to the Commission's proposal. Mainly clarififying that the proposal provides for an additional exemption. A lack of information typcially violates the "fairness" principle in Article 8(2) of the Charter.
#1114 Article 15 – paragraph 4 (Article 3 – paragraph 1 – point 5 a (new))
Authored by
Regulation (EU) 2016/679
Article 15 – paragraph 4
Present text
4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.Amendment
5a. In Article 15, paragraph 4 is replaced by the following: ‘4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others, including the right to a fair trial, the right to privacy and confidentiality of communications, and the protection of trade secrets. In particular, that right cannot be interpreted as a general right of access to documents containing the data subject’s personal data, but shall relate only to the personal data concerning him or her. The controller may restrict or refuse a request to obtain a copy where it is likely to adversely affect the rights and freedoms of others, and where the assessment or implementation of the measures necessary to prevent such an adverse affect would impose a burden that is manifestly disproportionate to the volume, nature or complexity of the documents concerned. The right to obtain a copy shall not apply to requests for information or documents that are unrelated to the purposes of the processing carried out by the controller or that are made exclusively in the context of a dispute, a pre-litigation phase or court proceedings between the controller and the data subject.’
noyb's comment:
This proposal tries to reduce the scope of access requests. Right of access is already covered in the Charter and the restrictions proposed in this proposal do not seem proportionate (e.g. whole areas excluded). Also, the proposal adds legal uncertainty. A limitation of uses of access rights violates the "access" element in Article 8(2) of the Charter.
#1115 Article 13 – paragraph 1 – points fa (new) and fb (new) (Article 3 – paragraph 1 – point 5 a (new))
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 1 – points fa (new) and fb (new)
Present text
No equivalentAmendment
5a. In Article 13, paragraph 1, the following points are added: "(fa) if the controller is a small, medium or large controller under Article 4(27) to (29) and; (fb) if the controller is a large controller, the number of data subjects they processed personal data about, the number of times data subjects have exercised their rights against them under Articles 13 to 22 and the number of each type of outcome, the number of data breaches under Article 32 and the number of likely affected data subjects, the number of procedures filed against them under Article 78 and 79, the certifications received or revoked under Article 42 and the name and contact details of the certification body that has certified them for the past three financial years."Justification
RISK-BASED APPROACH #8: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
This proposal adds additional information obligations regarding the controller’s size and even more information in case the controller is large. It is a package to limit obligations on SMEs and add requirements only for large controllers. Overall simplification.
#1123 Article 13 – paragraph 5 (Article 3 – paragraph 1 – point 6)
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 5
Text proposed by the Commission
5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.Amendment
5. When the processing takes place for scientific research purposes, including scientific research in the public interest aiming to further a commercial interest, and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort, including cases where the change of purpose could not have been anticipated at the time of collection, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available. This scenario shall apply equally to the obligations under Article 14(5)(b).
noyb's comment:
This proposal builds upon the Commission's proposal, but even decreases the level of privacy in those cases. It may violate the purpose limitation and fairness principle in Article 8(2) of the Charter.
#1125 Article 13 – paragraph 5 (Article 3 – paragraph 1 – point 6)
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 5
Text proposed by the Commission
5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.Amendment
5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort, including cases where the change of purpose could not have been anticipated at the time of collection, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available
noyb's comment:
This proposal builds upon the Commission's proposal, but apparently even tries to broaden the scope of the exemption. It may violate the purpose limitation and fairness principle in Article 8(2) of the Charter.
#1127 Article 14 – paragraph 5a (new) (Article 3 – paragraph 1 – point 6)
Authored by
Regulation (EU) 2016/679
Article 14 – paragraph 5a (new)
Text proposed by the Commission
Amendment
5a. In Article 14, paragraph 5a is added: '5a. The obligation to make information available pursuant to Article 14 shall be deemed fulfilled where such information is published and maintained in an easily accessible manner on the entity's website.'
noyb's comment:
This proposal provides for an easy (for controllers) way to provide the Article 14 information. However, data subjects would be unable to be aware of the processing of their data in numerous cases. In particular in case of Article 14 which applies when information is collected indirectly. Data subjects are therefore usually unaware. Sch a broad exemption is certainly not proportionate and therefore in violaution the fairness principle of Article 8(2) of the CFR.
#1128 Article 13 – paragraph 4a (new) (Article 3 – paragraph 1 – point 6 a (new))
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 4a (new)
Present text
Article 13 Information to be provided where personal data are collected from the data subject 1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: (a) the identity and the contact details of the controller and, where applicable, of the controller's representative; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; (e) the recipients or categories of recipients of the personal data, if any; (f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available. 2. In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability; (c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (d) the right to lodge a complaint with a supervisory authority; (e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; (f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. 3. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2. 4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.Amendment
6a. In Article 13, paragraph 4a is added: "Paragraphs 1 to 4 shall not apply to associations, foundations, and other non-profit organisations established in the Union, provided that: (a) the processing of personal data is limited to the administration of membership, volunteers, donors, or beneficiaries; (b) such processing is not likely to result in a high risk to the rights and freedoms of natural persons; and (c) the data are not shared with third parties for commercial purposes."Justification
Article 13 information obligations are essential for transparency, but they can create disproportionate administrative burdens for small non-profit organisations where the processing relationship is clear, direct and limited to internal administrative purposes. Associations, foundations and other non-profit organisations should therefore be allowed to fulfil transparency obligations through publicly accessible information where processing is limited to members, volunteers, donors or beneficiaries, does not involve systematic monitoring, is not likely to result in a high risk and is not used for commercial third-party sharing. This targeted clarification supports civic engagement and volunteer work while preserving the substance of the right to information.
noyb's comment:
This proposal adds an exemption from the information obligation similar to the Commission's proposal but limited in its scope. Unlike the Commission's proposal, this version is much clearer and the added legal uncertainty is probably lower than the administrative simplification. Such a broad ecemption of information duties likely violates the "fairness" principle in Article 8(2) of the Charter.
#1129 Article 15 – paragraph 1 – last sentence (Article 3 – paragraph 1 – point 6 a (new))
Authored by
Regulation (EU) 2016/679
Article 15 – paragraph 1 – last sentence
Present text
1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) where the personal data are not collected from the data subject, any available information as to their source; (h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.Amendment
6a. In Article 15, paragraph 1, the following sentence is added: "The right of access under this Article shall not extend to personal data which the data subject has created, authored, transmitted or received in the ordinary course of the relevant activity and which remain available to the data subject through the controller's systems or by other lawful means."
noyb's comment:
The amendment includes a derogation which is not foreseen in the current regime.Such a broad ecemption likely violates the "access" element in Article 8(2) of the Charter.
#1130 Article 14 – paragraph 1 – points fa and fb (new) (Article 3 – paragraph 1 – point 6 a (new))
Authored by
Regulation (EU) 2016/679
Article 14 – paragraph 1 – points fa and fb (new)
Present text
No equivalentAmendment
6a. In Article 14(1), the following points are added: "(fa) if the controller is a small, medium or large controller under Article 4(27) to (29), and; (fb) if the controller is a large controller, the number of data subjects they processed personal data about, the number of times data subjects have exercised their rights against them under Articles 13 to 22 and the number of each type of outcome, the number of data breaches under Article 32 and the number of likely affected data subjects, the number of procedure filed against them under Article 78 and 79, the certifications received or revoked under Article 42 and the name and contact details of the certification body that has certified them for the past three financial years."Justification
RISK-BASED APPROACH #9: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
Additional information and a package bringind simplification to SMEs while adding duties to larger controllers.
#1132 Article 13 – paragraph 4a (new) (Article 3 – paragraph 1 – point 6 a (new))
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 4a (new)
Text proposed by the Commission
Amendment
6a. In Article 13, paragraph 4a is added: '4a. The obligation to make information available pursuant to Article 13 shall be deemed fulfilled where such information is published and maintained in an easily accessible manner on the entity's website.'
noyb's comment:
This proposal provides for an easy (for controllers) way to provide the Article 13 information. However, data subjects would be unlikely to be aware of the processing of their data in some cases (e.g. the person may not know that his/her data is subject to a specific policy on some random website of a data broker). Such a broad exemption is not proportionate and therefore in violation of the "fairness" principle in Article 8(2) CFR. In particular, since it covers situation in which the data subject is unaware of the processing.
#1133 Article 15 – paragraph 3 (Article 3 – paragraph 1 – point 6 a (new))
Authored by
Regulation (EU) 2016/679
Article 15 – paragraph 3
Text proposed by the Commission
Amendment
6a. Article 15, paragraph 3 is amended as follows: 3. The controller shall provide the data subject with a copy of the personal data undergoing processing; that copy shall be confined to the personal data as such.
#1135 Article 15 – paragraph 3 (Article 3 – paragraph 1 – point 6 a (new))
Authored by
Regulation (EU) 2016/679
Article 15 – paragraph 3
Present text
3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes his or her request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.Amendment
(Does not affect the English version.)
noyb's comment:
The amendment imposes a new cost on the data subjects when requesting copy of their data.
#1137 Article 15 – paragraph 4 (Article 3 – paragraph 1 – point 6 b (new))
Authored by
Regulation (EU) 2016/679
Article 15 – paragraph 4
Text proposed by the Commission
Amendment
6b. Article 15, paragraph 4 is amended as follows: 4. The right of access referred to in paragraphs 1 and 2 and the right to obtain a copy referred to in paragraph 3 shall not affect the rights and freedoms of other persons, including the controller. Paragraph 3 shall not apply if and to the extent that the provision of the copy proves impossible or would require a disproportionate effort.
noyb's comment:
The amendment restricts the right to access and highlights a balancing test in favour of less privacy. Such a broad exemption likely violates the "access" element in Article 8(2) of the Charter.
#1154 Article 22 – paragraph 1 – point ca (new) (Article 3 – paragraph 1 – point 7)
Authored by
Regulation (EU) 2016/679
Article 22 – paragraph 1 – point ca (new)
Text proposed by the Commission
Amendment
(ca) is taken by an AI system which can be reviewed and overseen by a natural person before or after it takes effect, and where appropriate safeguards are in place;
noyb's comment:
Introduces a rather broad exemption from the general ADM prohibition withoug any regard on necessity. This proposal also introduces legal uncertainty since it is not clear, what appropriate safeguards would be and how a "review" or "oversight" after the decision takes effect should be understood.
#1164 Article 31 – paragraph 1a (new) (Article 3 – paragraph 1 – point 7 a (new))
Authored by
Regulation (EU) 2016/679
Article 31 – paragraph 1a (new)
Present text
No equivalentAmendment
7a. In Article 31, the following paragraph is added: "1a. Large controllers shall report all information complied under Article 13(1f2) and 14(1f2) and the certification under Article 42, as well as any other information the supervisory authority may specify, to the supervisory authority at their main establishment or the main establishment of their representative under Article 27. The information shall be provided no later than one month after the end for their financial year in a machine-readable format specified by the supervisory authority. The supervisory authorities shall compile and keep up to date a public national list of all large controllers, including their address, contact details, number of data subjects processed in the last three financial years, the certification body that most recently certified them, number of procedures under Article 77 and 79 and a link to the information published under Article 13 and 14."Justification
RISK-BASED APPROACH #10: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
Introducing additional reporting obligations for large controller will increase the level of privacy since it is much easier for supervisory authorities to detect non-compliance. Similarly, large controller will take into account their duty to provide this information to the supervisory authority when drafting the documents. On the other hand, introducing additional reporting obligations will make it more complex to comply and will therefore not result in a simplification. Part of a package that will (overall) lead to simplification.
#1168 Article 28 – paragraphs 3a, 3b, 3c (new) and paragraph 4 (Article 3 – paragraph 1 – point 7 b (new))
Authored by
Regulation (EU) 2016/679
Article 28 – paragraphs 3a, 3b, 3c (new) and paragraph 4
Text proposed by the Commission
Amendment
7b. In Article 28, the following paragraphs 3a, 3b and 3c are added and paragraph 4 is amended as follows: '3a. By way of derogation from paragraph 3 and the general processor requirements therein, where a processor has been designated as a gatekeeper pursuant to Article 3 of Regulation (EU) 2022/1925, the processing shall instead be governed directly by this Regulation. Any such gatekeeper processor shall strictly adhere to the following obligations: (a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; (b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; (c) takes all measures required pursuant to Article 32; (d) respects the conditions referred to in paragraphs 2 and 4 for engaging another processor; (e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III; (f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor; (g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data; (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions. 3b. A controller that is using a gatekeeper as a processor may form a contract or other legal act under Union or Member State law, that is binding on the gatekeeper processor and that sets out further details, like the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. Such contracts shall not contain terms that are unfair or limit the rights of the controllers under this Regulation. 3c. A contractual term shall be regarded as unfair if it requires undue extra payment for the exercise of rights of the controller, limits the rights of the controller to enforce the contract or otherwise legally, factually or economically interferes with the rights of controllers under this Regulation. The European Commission shall specify further terms of a contract that are regarded as unfair in accordance with the examination procedure referred to in Article 93(2). 4. Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in paragraph 3 to 3c shall apply or, if this Regulation does not apply to them directly, be imposed on that other processor by way of a contract or other legal act under Union or Member State law and jurisdiction, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor’s obligations.'
noyb's comment:
The proposed text includes additional safeguards in the GDPR against gatekeepers designated by the DMA. This can be an overall benefit to the fundamental rights of data subjects. It can also lead to simpler transactions in B2B relationships.
#1170 Article 25 – paragraphs 3a, 3b (new) (Article 3 – paragraph 1 – point 7 b (new))
Authored by
Regulation (EU) 2016/679
Article 25 – paragraphs 3a, 3b (new)
Present text
No equivalentAmendment
7b. In Article 25, the following paragraphs are added: "3a. Where personal data processing under paragraph 2 is carried out exclusively by means of Privacy-Enhancing Technologies certified pursuant to paragraph 4, the data controller shall benefit from a rebuttable presumption of compliance with the data minimisation principle under Article 5(1)(c) of Regulation (EU) 2016/679 in respect of that processing. All other obligations under Regulation (EU) 2016/679 shall continue to apply. 3b. The Commission shall be empowered to adopt delegated acts recognising Privacy-Enhancing Technologies (PETs) and establishing the technical standards and criteria for Privacy-Enhancing Technologies eligible for certification under paragraph 3, following the governance model established in Article 41a of Regulation (EU) 2016/679. Those delegated acts shall be adopted in accordance with the examination procedure and following consultation with relevant authorities as appropriate. Standards shall include benchmarks to prevent misuse of PET certification for data practices that do not genuinely meet minimum privacy thresholds."Justification
Certified PETs make data protection by design operational. Technologies such as differential privacy, homomorphic encryption, synthetic data and robust pseudonymisation reduce identifiability and support data minimisation while enabling data-driven innovation and AI. A rebuttable presumption under Article 5(1)(c) creates a real incentive to deploy certified PETs without exempting controllers from other GDPR duties. Commission-set, technology-neutral standards and benchmarks prevent PET-washing and support interoperable European privacy infrastructure.
noyb's comment:
Although PETs are at all times welcome and can indeed help in achieving an entity's obligations under the GDPR (such as compliance with Article 25), due to the rapidly evolving nature of digital technologies, codifying specific tools (PETs) can prove useless. The European Commission is welcome to provide Guidelines and recommendations on PETs, however, this should be of periodical nature, rather than codified in the GDPR itself.
#1173 Article 25 – paragraph 2a (new) (Article 3 – paragraph 1 – point 7 c (new))
Authored by
Regulation (EU) 2016/679
Article 25 – paragraph 2a (new)
Present text
No equivalentAmendment
7c. In Article 25, the following paragraph 2a is added: "2a. In the case of processing carried out in the course of providing information society services which are likely to be accessed by children, when assessing what are appropriate technical and organisational measures in accordance with paragraph 1, the controller must take into account the children’s higher protection matters. The children’s higher protection matters are: (a) how children can best be protected and supported when using the services, and; (b) the fact that children: (i) merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing; and (ii) have different needs at different ages and at different stages of development. This paragraph is not to be read as implying anything about the matters that may be relevant to the assessment of what are appropriate technical and organisational measures for the purposes of paragraph 1 and 2 in cases other than those described in this paragraph. In this paragraph “information society services” does not include preventive or counselling services."Justification
The amendment makes children’s higher protection needs a concrete part of data protection by design for information society services likely to be accessed by children. Controllers must consider how children can best be protected and supported, including their lower awareness of risks and their different needs at different ages and development stages. This creates clearer duties without a one-size-fits-all model, preserves other Article 25 assessments and excludes preventive or counselling services.
noyb's comment:
Although this amendment is a step in the direction of promoting data protection, it is lacking substance with regards to how an entity should take the provided requirements into account, what are the specific requirements, and how should the analysis and implementation of the requirements be documented by the relevant entities in order to prove their compliance to Article 25(2a).
#1174 Article 28 (Article 3 – paragraph 1 – point 7 d (new))
Authored by
Regulation (EU) 2016/679
Article 28
Present text
1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. 2. The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. 3. Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: (a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; (b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; (c) takes all measures required pursuant to Article 32; (d) respects the conditions referred to in paragraphs 2 and 4 for engaging another processor; (e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III; (f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor; (g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data; (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions. 4. Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to thecontroller for the performance of that other processor's obligations. 5. Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as referred to in paragraphs 1 and 4 of this Article. 6. Without prejudice to an individual contract between the controller and the processor, the contract or the other legal act referred to in paragraphs 3 and 4 of this Article may be based, in whole or in part, on standard contractual clauses referred to in paragraphs 7 and 8 of this Article, including when they are part of a certification granted to the controller or processor pursuant to Articles 42 and 43. 7. The Commission may lay down standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the examination procedure referred to in Article 93(2). 8. A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the consistency mechanism referred to in Article 63.Amendment
7d. Article 28 is amended as follows: "1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. 2. Where the processor engages further processors, the processor shall always inform the controller of any intended change relating to the engagement or replacement of other processors, thereby giving the controller the opportunity to object to such changes. 3. Where the processing of personal data takes place under an agreement with the controller which specifies the subject matter and duration of the processing, the nature and purpose of the processing, the types of data to be processed and the categories of data subjects (processing on behalf of the controller), the processor may process the personal data only for the purposes of carrying out the contract or in accordance with other documented instructions from the controller — including in relation to the transfer of personal data to a third country or an international organisation — unless the processor is obliged to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of those legal requirements prior to processing, unless the law in question prohibits such notification on grounds of an important public interest. The data processor shall ensure: (a) that persons authorised to process personal data have undertaken to maintain confidentiality or are subject to an appropriate statutory duty of confidentiality; (b) that all measures necessary for the performance of the contract, as set out in Article 32, are taken; (c) that the conditions set out in paragraphs 2 and 4 regarding the use of the services of a further processor are complied with; The processor shall assist the controller in: (a) fulfilling the controller’s obligations to respond to requests for the exercise of the data subject’s rights referred to in Chapter III, where possible by taking appropriate technical and organisational measures, taking into account the nature of the processing; (b) to comply with the controller’s obligations set out in Articles 32 to 36, taking into account the nature of the processing and the information available to the controller. The processor is obliged: (a) upon completion of the processing operations, to either erase or return all personal data, at the choice of the controller, unless there is an obligation under Union law or the law of the Member States to retain the personal data; (b) to provide the controller with all necessary information to demonstrate compliance with the obligations laid down in this Article, and to allow for and cooperate with audits – including inspections – carried out by the controller or another auditor mandated by the controller. With regard to paragraph 4(b), the processor shall inform the controller without delay if it considers that an instruction infringes this Regulation or other data protection provisions of the Union or the Member States. 4. Where the processor engages the services of another processor to carry out specific processing activities on behalf of the controller, the following shall apply to that other processor: (a) the obligations set out in paragraph 3 shall apply mutatis mutandis or, where this Regulation does not apply to that processor pursuant to Articles 2 and 3, (b) by means of a contract or other legal instrument under Union law or the law of the Member State concerned, the same data protection obligations as those laid down between the controller and the processor in accordance with paragraph 3, whereby, in particular, sufficient safeguards must be provided to ensure that the appropriate technical and organisational measures are implemented so that the processing is carried out in accordance with the requirements of this Regulation. If the sub-processor fails to fulfil its data protection obligations, the first processor shall be liable to the controller for the fulfilment of the obligations of that sub-processor . 5. Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as referred to in paragraphs 1 and 4 of this Article. Paragraph 6, 7, and 8 are deleted. 9. The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form. 10. Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing. 10a. Notwithstanding paragraph 3, the agreement between the controller and the processor need not specify the nature and purpose of the processing, the types of data to be processed and the categories of data subjects, as required by the first sentence of paragraph 3, if (a) the processor provides a binding assurance as to the level of protection to which it is able to ensure the security of the processing and its obligation to assist the controller in accordance with the third sentence by means of appropriate technical and organisational measures; and (b) the controller confirms the suitability of these safeguards for the processing operations it intends to carry out (infrastructure processing). Paragraph 2 shall not apply in the context of infrastructure data processing insofar as: (a) data transfers to further processors are envisaged on the basis of Article 45 or safeguards pursuant to Article 46(2)(b), (e) and (f), and enforceable rights and effective remedies are available to data subjects; and (b) the first processor undertakes to the controller and the data subjects to assume liability for compliance with the obligations of the subsequent processors."Justification
Article 28 should better reflect modern cloud, hosting, security and infrastructure services, which are standardised, layered and technically complex. For such infrastructure processing, controllers need enforceable assurances on security, assistance and downstream liability, not bespoke descriptions of every technical sub-operation. The amendment cuts formalistic contract burdens while preserving core duties: confidentiality, security, assistance, deletion or return, audits, controller suitability checks and processor liability for sub-processors.
noyb's comment:
The amendment introduces new derogations in relation to Article 28 which is not foreseen in the current regime.
#1175 Article 28 (Article 3 – paragraph 1 – point 7 e (new))
Authored by
Regulation (EU) 2016/679
Article 28
Present text
Article 28 GDPR Processor 1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. 2. The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. 3. Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: (a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; (b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; (c) takes all measures required pursuant to Article 32; (d) respects the conditions referred to in paragraphs 2 and 4 for engaging another processor; (e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III; (f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor; (g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data; (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions. 4. Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. 2Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor’s obligations. 5. Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as referred to in paragraphs 1 and 4 of this Article. 6. Without prejudice to an individual contract between the controller and the processor, the contract or the other legal act referred to in paragraphs 3 and 4 of this Article may be based, in whole or in part, on standard contractual clauses referred to in paragraphs 7 and 8 of this Article, including when they are part of a certification granted to the controller or processor pursuant to Articles 42 and 43. 7. The Commission may lay down standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the examination procedure referred to in Article 93(2). 8. A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the consistency mechanism referred to in Article 63. 9. The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form. 10. Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing.Amendment
7e. Article 28 is replaced by the following: "Article 28 GDPR Processor 1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. 2. The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. 3. Any processor shall: (a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; (b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; (c) takes all measures required pursuant to Article 32; (d) respects the conditions referred to in paragraphs 2 and 4 for engaging another processor; (e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III; (f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor; (g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data; (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions. 3a. A controller may from a contract or other legal act under Union or Member State law, that is binding on the processor and that sets out further details, like the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. Such contracts shall not contain terms that are unfair or limit the rights and role of the controllers under this Regulation. 3b. A contractual term shall be regarded as unfair and void if it requires undue extra payment for the exercise of rights of the controller, limits the rights of the controller to enforce the contract or otherwise legally, factually or economically interferes with the rights of controllers under this Regulation. The European Commission may specify further terms of a contract that are regarded as unfair in accordance with the examination procedure referred to in Article 93(2). 4. Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in paragraph 3 to 3b shall apply or, if this Regulation does not apply to them directly, be imposed on that other processor by way of a contract or other legal act under Union or Member State law and at least the jurisdiction of a Member State, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor’s obligations. 5. Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as referred to in paragraphs 1 and 4 of this Article. 6. Without prejudice to an individual contract between the controller and the processor, the contract or the other legal act referred to in paragraphs 3 and 4 of this Article may be based, in whole or in part, on standard contractual clauses referred to in paragraphs 7 and 8 of this Article, including when they are part of a certification granted to the controller or processor pursuant to Articles 42 and 43. 7. The Commission may lay down standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the examination procedure referred to in Article 93(2). 8. A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the consistency mechanism referred to in Article 63. 9. The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form. 10. Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing."Justification
Alternative to other Art 28 proposal. Attempts also to shift burdens from SMEs to large processors, hyperscalers and software producers. This change would make the duties directly applicable to processors, removing the need for millions of B2B contracts.
noyb's comment:
This is a step in the correct direction as paragraph 3 codifies the requirements of Article 28(3) without requiring a contract. Overall, it strengthens the position of controllers.
#1179 Article 33 – paragraph 1 (Article 3 – paragraph 1 – point 8 – point a)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 1
Text proposed by the Commission
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.Amendment
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the national entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56 of this Regulation. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.
#1180 Article 33 paragraph 1 (Article 3 – paragraph 1 – point 8 – point a)
Authored by
Regulation (EU) 2016/679
Article 33 paragraph 1
Text proposed by the Commission
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.Amendment
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the national entry point established pursuant to Article 23b of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56 of this Regulation. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.
noyb's comment:
Apparently, no material changes to the Commission's proposal; the change of 23a to 23b is probably due to a different proposed amendment to the single entry point regime. the
#1181 Article 33 – paragraph 1 (Article 3 – paragraph 1 – point 8 – point a)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 1
Text proposed by the Commission
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.Amendment
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the national entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56 of this Regulation. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.
noyb's comment:
Apparently, no material changes to the Commission's proposal.
#1192 Article 33 – paragraph 6 (Article 3 – paragraph 1 – point 8 – point c)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 6
Text proposed by the Commission
6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).Amendment
6. The Board shall establish and make public common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person and a list of the circumstances in which it is not likely to result in such a high risk.. The template and lists shall be available to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2). 7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6.’
noyb's comment:
This amendment, in particular, follows some considerations of the EDPB/EDPS opinion and adds the creation of a white-list the documents the Board shall establish, providing increased legal certainty.
#1194 Article 33 – paragraph 6 (Article 3 – paragraph 1 – point 8 – point c)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 6
Text proposed by the Commission
6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).Amendment
6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2). This shall not go beyond existing obligations under this Regulation or mandate any retroactive obligations.
noyb's comment:
This provision provides for a mere clarification. Even if the clarification is stated one-sided it does not have a significant effect on privacy or simplification.
#1201 Article 34 – paragraph 2 (Article 3 – paragraph 1 – point 8 a (new))
Authored by
Regulation (EU) 2016/679
Article 34 – paragraph 2
Text proposed by the Commission
Amendment
8a. Article 34, paragraph 2 is amended as follows: 2. The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in points (b), (c) and (d) of Article 33(3) and, where possible, the categories of personal data records concerned.
noyb's comment:
This proposal adds the categories of personal data records concerned to the information required under Article 34(2), providing data subjects with more information. Since the controller already needs to have this information, the added administrative work in adding this information to the communication is insignificant.
#1204 Article 35 – paragraph 4 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 4
Text proposed by the Commission
4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.Amendment
4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1. In preparing its proposal, the Board shall take due account of the lists established and made public by supervisory authorities and relevant guidance of the Board, and shall ensure that its proposal reflects a consistent and proportionate approximation of the common elements of those lists, focusing on processing operations most likely to result in high risk. Newly identified triggers shall apply prospectively to new processing or materially changed processing.Justification
Reducing fragmentation and legal uncertainty while ensuring that compliance requirements remain proportionate and focused on genuinely high-risk activities should be at the core of the Digital Omnibus, in order to avoid unnecessary burdens for SMEs.
noyb's comment:
Besides rather neutral clarifications, the last sentence seems to suggest that only new or changed processing activities should be subject to a DPIA if circumstances change. But even existing processing activities should regularly reassessed and in could be subject to a DPIA even if this was not done in the past.
#1205 Article 35 – paragraph 4 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 4
Text proposed by the Commission
4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.Amendment
4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1. In preparing its proposal, the Board shall take due account the lists of processing operations established and made public by supervisory authorities and shall ensure that its proposal reflects a consistent and proportionate approximation of the processing operations identified in those lists, taking into account the principle of legal certainty.
#1209 Article 35 – paragraph 4 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 4
Text proposed by the Commission
4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.Amendment
4. The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.
noyb's comment:
Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.
#1214 Article 35 – paragraph 5 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 5
Text proposed by the Commission
5. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.Amendment
5. Processing operations not covered by the list in paragraph 4 shall not be subject to the requirement for a data protection impact assessment pursuant to paragraph 1.
noyb's comment:
This template would reduce factually reduce the cases in which a controller would prepare a DPIA, resulting in a lower level of data protection but less administrative work for controllers.
#1217 Article 35 – paragraph 6 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 6
Text proposed by the Commission
6. The Board shall prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments.Amendment
6. The Board shall establish a common template and a common methodology for conducting data protection impact assessments.
noyb's comment:
Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.
#1224 Article 35 – paragraph 6a (Article 3 – paragraph 1 – point 9 – point b)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 6a
Text proposed by the Commission
6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).Amendment
6a. The proposal for the list referred to in paragraph 4 and for the template and methodology referred to in paragraph within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2). That list shall be based on convergence area from national authorities and shall not introduce new categories of processing operations that go beyond existing obligations under this Regulation. Processing operations lawfully in place at the time of their initiation shall not be subject to a retroactive obligation to carry out a data protection impact assessment as a result of the adoption of the harmonised list.
noyb's comment:
This proposal (apparently subject to editorial mistakes) tries to narrow the scope of potential processing activities subject to a DPIA; therefore, it lowers the level of data protection. It also introduces some legal uncertainty, offsetting a potential reduction in administrative workload.
#1236 Article 35 – paragraph 9 (Article 3 – paragraph 1 – point 9 a (new))
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 9
Present text
9. Where appropriate, the controller shall seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of processing operations.Amendment
"deleted"
noyb's comment:
This amendment deletes the controller’s obligation to seek input from the perspective of the data subjects affected by the intended processing. Lowering the level of data protection but reducing the workload for controllers.
#1237 Article 37 – paragraph 7 (Article 3 – paragraph 1 – point 9 a (new))
Authored by
Regulation (EU) 2016/679
Article 37 – paragraph 7
Text proposed by the Commission
Amendment
9a. Article 37, paragraph 7, is amended as follows: The controller or the processor shall publish the contact details of the data protection officer.
noyb's comment:
This proposal gets rid of the controllers or processors obligation to communicate the contact details of the DPO to the supervisory authority. Therefore, this takes away the DPA’s option to check whether a DPO is appointed or draw up statistics like how many DPA’s are appointed in a single year. Similarly, in case of a complaint against a controller, the supervisory authority could see whether the controller has / had a DPO at the time of the violation. However, getting rid of the reporting obligation reduces complexity for controllers.
#1238 Article 37 – paragraph 4 (Article 3 – paragraph 1 – point 9 a (new))
Authored by
Regulation (EU) 2016/679
Article 37 – paragraph 4
Present text
4. In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may or, where required by Union or Member State law shall, designate a data protection officer. The data protection officer may act for such associations and other bodies representing controllers or processors.Amendment
9a. In Article 37, paragraph 4 is replaced by the following: "4. In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may designate a data protection officer. The data protection officer may act for such associations and other bodies representing controllers or processors."Justification
DPO Package #2: The amendment strengthens accountability by recognising DPOs as practical governance safeguards and first points of contact for complaints. DPOs already advise controllers and processors, monitor compliance and support data subjects; giving them an explicit complaint-handling role makes resolution faster, less bureaucratic and closer to the facts. Voluntary or shared DPOs are encouraged. Supervisory authorities remain available where the complaint is not addressed or not fully remedied within one month.
noyb's comment:
The proposal deletes the option to introduce the requirement to appoint a DPO by Member State or Union law. E.g. in case a specific processing activity subject to a Member State or Union law is considered quite risky they could require the appointment of a DPO even if the requirements in Article 37(1) are not met. While this potentially reduces the level of data protection, it reduces compliance efforts by the controller who does not have to check potential additional obligations to appoint a DPO.
#1240 Article 39 – paragraph 1 – point ea (new) (Article 3 – paragraph 1 – point 9 b (new))
Authored by
Regulation (EU) 2016/679
Article 39 – paragraph 1 – point ea (new)
Present text
No equivalentAmendment
9b. In Article 39, paragraph 1 the following point ea is added: "'(ea) to handle complaints from a data subject or complaints from a body, organisation or association pursuant to Article 80 against the processing of personal data by the controller or the processor, to investigate the subject matter of the complaint to an appropriate extent, and to advise the controller or the processor on appropriate remedial measures in the event of a breach of this Regulation.'"Justification
DPO Package #3: The amendment strengthens accountability by recognising DPOs as practical governance safeguards and first points of contact for complaints. DPOs already advise controllers and processors, monitor compliance and support data subjects; giving them an explicit complaint-handling role makes resolution faster, less bureaucratic and closer to the facts. Voluntary or shared DPOs are encouraged. Supervisory authorities remain available where the complaint is not addressed or not fully remedied within one month.
noyb's comment:
While the DPO should be involved when complaints or lawsuits are filed against the controller, the DPO should not be tasked to handle those as this would be a massive conflict of interest since this would naturally entail defending the controller against any allegations made. (See Art-19 WP WP 243 rev.01 Guidelines on Data Protection Officers, p 19)
#1252 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 1
Text proposed by the Commission
(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.Amendment
(1) The Commission may adopt implementing acts to specify means and criteria to determine when data (a) is merely transitory in nature; (b) is unrelated to the data subject as an identified or identifiable natural person; (c) has appropriate technical and/or organisational safeguards to prevent any use for a purpose related to the data subject as an identified or identifiable natural person.
noyb's comment:
While more privacy-oriented than the original Commission's proposal, the Parliament's amendment delegates powers to the Commission that form functions of the EDPB. The power to make such decisions lies with independet SAs under Article 8(3) of the Charter.
#1254 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 1
Text proposed by the Commission
(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.Amendment
(1) The Commission may adopt implementing acts to specify technical and organisational measures and criteria supporting controllers in assessing whether data resulting from anonymisation or pseudonymisation no longer constitutes personal data for certain entities and in preventing the risk of re-identification.
noyb's comment:
The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1) and 4(6).
#1256 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 1
Text proposed by the Commission
(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.Amendment
(1) The Commission may adopt implementing acts to specify the technical means and any relevant criteria to determine whether data resulting from pseudonymisation constitutes anonymized data that no longer constitutes personal data for a specific entity. (Article 41 new of Regulation (EU) 2016/679)
noyb's comment:
The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1), and CJEU case law, such as C-319/22 Gesamtverband Autoteile-Handel eV v. Scania.
#1257 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 1
Text proposed by the Commission
(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.Amendment
(1) The Commission may adopt implementing acts to specify means and criteria to determine when data:
#1258 Article 41 – paragraph 1 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41 – paragraph 1
Text proposed by the Commission
(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.Amendment
(1) The Commission may adopt implementing acts providing specifications, criteria, methodologies and practical requirements necessary to ensure the uniform application of this Regulation throughout the Union.Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
The power to make such decisions lies with independet SAs under Article 8(3) of the Charter. This would allow the (political) COM to interfere with the rights of SAs.
#1259 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 1
Text proposed by the Commission
(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.Amendment
(1) The Commission may adopt implementing acts to specify means and criteria to determine when data no longer constitutes personal data for certain entities.
noyb's comment:
The amendment improves the Commission's proposal but risks remaining a decrease of protection compared to the current Article 4(1) and overall standards of what counts as personal data. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1260 Article 41a – paragraph 1 – subparagraphs a, b, c (new) (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 1 – subparagraphs a, b, c (new)
Text proposed by the Commission
Amendment
(1a) In Article 41a, paragraph 1, the following subparagraphs a, b, c are added: '(a) is merely transitory in nature; (b) is unrelated to the data subject as an identified or identifiable natural person; (c) has appropriate technical and/or organisational safeguards to prevent any use for a purpose related to the data subject as an identified or identifiable natural person.'
noyb's comment:
Does not add anything material towards the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1265 Article 41 – paragraph 2 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41 – paragraph 2
Text proposed by the Commission
(2) For the purpose of paragraph 1 the Commission shall:Amendment
(2) 2. Implementing acts adopted under paragraph 1 may in particular:Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not change anything material in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights.
#1267 Article 41a – paragraph 2 – point a (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
Text proposed by the Commission
(a) assess the state of the art of available techniques;Amendment
(a) specify criteria and methodologies for assessing whether data resulting from anonymisation or pseudonymisation can reasonably be used to identify or re-identify a natural person;Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not change anything material in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1268 Article 41a – paragraph 2 – point a (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
Text proposed by the Commission
(a) assess the state of the art of available techniques;Amendment
(a) assess the state of the art of available techniques , including Privacy Enhancing Technologies (PET);
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights.Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1269 Article 41a – paragraph 2 – point a (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
Text proposed by the Commission
(a) assess the state of the art of available techniques;Amendment
(a) assess the state of the art of available techniques, such as privacy- enhancing technologies;
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1270 Article 41a – paragraph 2 – point a (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
Text proposed by the Commission
(a) assess the state of the art of available techniques;Amendment
(a) assess the state of the art of available techniques such as privacy enhancing technologies;;
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1271 Article 41a – paragraph 2 – point a (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
Text proposed by the Commission
(a) assess the state of the art of available techniques;Amendment
(a) assess the state of the art of available technical means;
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1273 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
Text proposed by the Commission
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.Amendment
(b) develop criteria to assess the risk of re-identification in practice in relation to typical recipients of data. The criteria should take into account, inter alia, the likelihood of identifying a natural person, the possibility of linking records relating to a natural person, and the potential of inferring information concerning a natural person.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1275 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
Text proposed by the Commission
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.Amendment
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data, taking into account objective factors such as cost, amount of time required, available technology, legal obligations.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1276 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
Text proposed by the Commission
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.Amendment
(b) develop criteria and or categories for controllers and recipients to assess the risk of data being used for a purpose related to the data subject as an identified or identifiable natural person
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1278 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
Text proposed by the Commission
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.Amendment
(b) develop criteria and or categories for controllers and recipients to assess the risk of data being used for a purpose related to the data subject as an identified or identifiable natural person.
noyb's comment:
Does not bring material change in regards to the Commision's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1279 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
Text proposed by the Commission
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.Amendment
(b) develop criteria and or categories for controllers and recipients to assess the risk of data being used for a purpose related to the data subject as an identifiable natural person
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1280 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
Text proposed by the Commission
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.Amendment
(b) specify methodologies for assessing risks to the rights and freedoms of natural persons;Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1281 Article 41a – paragraph 2 – point ba (new) (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point ba (new)
Text proposed by the Commission
Amendment
(ba) In Article 41a, paragraph 2, the following point ba is added: '(ba) assess technical, administrative, organisational and contractual measures that can prevent the risk of re-identification.'
noyb's comment:
Does not add anything material towards the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1282 Article 41a – paragraph 2 – point ba (new) (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point ba (new)
Text proposed by the Commission
Amendment
(ba) In Article 41a, paragraph 2, the following point ba is added: '(ba) establish or approve Union-wide Codes of Conduct pursuant to Article 40 where harmonised application is necessary;'Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1283 Article 41a – paragraph 2 – point bb (new) (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point bb (new)
Text proposed by the Commission
Amendment
(bb) In Article 41a, paragraph 2, the following point ba is added: '(bb) establish or approve Certification mechanisms, seals and marks pursuant to Article 42, including certification criteria and conditions for accreditation of certification bodies;'Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1284 Article 41a – paragraph 2 – point bc (new) (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point bc (new)
Text proposed by the Commission
Amendment
(bc) In Article 41a, paragraph 2, the following point ba is added: '(bc) specify common technical and organisational measures that may be used to demonstrate compliance with this Regulation;'Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1285 Article 41a – paragraph 2 – point bd (new) (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point bd (new)
Text proposed by the Commission
Amendment
(bd) In Article 41a, paragraph 2, the following point ba is added: '(bd) identify sector-specific circumstances, processing operations or use cases where harmonised interpretation is necessary to avoid fragmentation of the internal market.'Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1289 Article 41a – paragraph 3 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 3
Text proposed by the Commission
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.Amendment
(3) The implementation of the technical and organisational measures and criteria outlined in an implementing act may be used as an element to demonstrate that pseudonymised data do not lead to reidentification of the data subjects in a specific case.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1290 Article 41a – paragraph 3 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 3
Text proposed by the Commission
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.Amendment
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot be used for any purpose related to the data subjects as an identified or identifiable natural person.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1291 Article 41a – paragraph 3 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 3
Text proposed by the Commission
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.Amendment
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot be used for any purpose related to the data subjects as an identified or identifiable natural person.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1292 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 1
Text proposed by the Commission
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.Amendment
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot be used for any purpose related to the data subjects as an identifiable natural person.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1293 Article 41a – paragraph 3 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 3
Text proposed by the Commission
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.Amendment
(3) Compliance with specifications, criteria or methodologies set out in implementing acts adopted under this Article may be used by controllers and processors as an element to demonstrate compliance with this Regulation.Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1294 Article 41 new – paragraph 3 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41 new – paragraph 3
Text proposed by the Commission
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.Amendment
(3) The implementation of the means and criteria outlined in an implementing act may be used by an entity as an element to demonstrate that data cannot lead to reidentification of the data subjects by that entity.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. The "fully subjective" approach is not alinged with Article 8 of the Charter as interpreted by the CJEU (see e.g. Fashion ID).
#1296 Article 41a – paragraph 4 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 4
Text proposed by the Commission
(4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.Amendment
(4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion, which shall be made public, on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Decisions on the application of the law are generally reserved to independent SAs under Article 8(3) of the Charter.
#1297 Article 41 – paragraph 4 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41 – paragraph 4
Text proposed by the Commission
(4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.Amendment
(4) The Commission shall closely involve the European Data Protection Board in the preparation of implementing acts under this Article. The European Data Protection Board shall issue an opinion within eight weeks of receipt of the draft implementing act.Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Decisions on the application of the law are generally reserved to independent SAs under Article 8(3) of the Charter.
#1300 Article 41a – paragraph 5 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 5
Text proposed by the Commission
(5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).Amendment
(5) The implementing acts referred to in this Article shall be adopted in accordance with the examination procedure referred to in Article 93(3).Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
The amendment does not include any new substantive element.
#1302 Article 41b (new) (Article 3 – paragraph 1 – point 10 a (new))
Authored by
Regulation (EU) 2016/679
Article 41b (new)
Text proposed by the Commission
Amendment
10a. The following Article 41b is inserted: 'Article 41b Application of pseudonymisation and identification of a natural person (1) Controllers and processors may apply pseudonymisation, and anonymisation, or other Privacy Enhancing Technologies referred to in Article 25a to personal data in order to reduce the risks to the data subjects concerned and to help meet their obligations under this Regulation, in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information. To determine whether a natural person is identifiable, including through personal data having undergone pseudonymisation, account shall be taken of all the means reasonably likely to be used, such as singling out or online identifiers, either by the controller or by another person to identify the natural person directly or indirectly. (2) Paragraph 1 is without prejudice to other provisions and obligations applicable to the controller and processor, including under Chapter IV and V of this Regulation. (3) The Board shall issue an opinion, in accordance with Article 64(2) of this Regulation, addressing the application of pseudonymisation and anonymisation to personal data, including related technical and organisational measures, and specifying means and criteria to determine whether and when such may effectively prevent persons other than the controller from identifying a data subject, in such a way that, for them, the data subject is not or is no longer identifiable, and where information relating to the data subject no longer constitutes personal data for that person other than the controller. (4) The Chair of the Board shall request the opinion referred to in paragraph 3 no later than 6 months after the entry into force of this Regulation. The opinion shall be reviewed and updated where necessary. (5) The Commission may adopt implementing acts specifying technical and organisational criteria, methodologies and standards where necessary to ensure uniform conditions for the application of paragraphs 1 and 3, or where further clarity is required following the issuance of the opinion referred to in paragraph 3, The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).'
noyb's comment:
The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1) and Article 4(5).
#1303 Article 42 – paragraphs 3 and 7 (Article 3 – paragraph 1 – point 10 a (new))
Authored by
Regulation (EU) 2016/679
Article 42 – paragraphs 3 and 7
Present text
3. The certification shall be voluntary and available via a process that is transparent. 7. Certification shall be issued to a controller or processor for a maximum period of three years and may be renewed, under the same conditions, provided that the relevant criteria continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the criteria for the certification are not or are no longer met.Amendment
10a. In Article 42, paragraph 3 and 7 are amended as follows: "3. The certification shall be voluntary and available via a process that is transparent for small and medium controllers and large processors. Large controllers must be certified within one year after meeting the conditions in Article 4(28). 7. Certification shall be issued to a controller or processor for a maximum period of three years for small and medium controller and large processors. Certifications shall be issued for a maximum period of one year for large controllers. It may be renewed, under the same conditions, provided that the relevant criteria continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the criteria for the certification are not or are no longer met."Justification
RISK-BASED APPROACH #11: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
Part of a larger package. This would introduce certification for large controllers, which can also lower transaction costs for other controllers engaging with them and limit the need of resources by SAs.
#1305 Article 43 – paragraphs 2 and 7 (Article 3 – paragraph 1 – point 10 b (new))
Authored by
Regulation (EU) 2016/679
Article 43 – paragraphs 2 and 7
Present text
2. Certification bodies referred to in paragraph 1 shall be accredited in accordance with that paragraph only where they have: 7. Without prejudice to Chapter VIII, the competent supervisory authority or the national accreditation body shall revoke an accreditation of a certification body pursuant to paragraph 1 of this Article where the conditions for the accreditation are not, or are no longer, met or where actions taken by a certification body infringe this Regulation.Amendment
10b. In Article 43, paragraphs 2 and 7 are replaced by the following: "2. Certification bodies referred to in paragraph 1 shall be accredited in accordance with that paragraph only where they have: (ea) have not repeatedly and knowingly certified processing or other conduct that clearly violated guidelines or recommendation under Article 70(1)(d) that was issued before the certification or have not repeatedly and knowingly certified processing that was later subject to corrective powers under Article 58(2) or fines under Article 83. 7. Without prejudice to Chapter VIII, the competent supervisory authority or the national accreditation body shall revoke an accreditation of a certification body pursuant to paragraph 1 of this Article where the conditions for the accreditation are not, or are no longer, met or where actions taken by a certification body infringe this Regulation. Supervisory authorities shall report complaints under Article 77, any exercise of corrective powers under Article 58(2) and any fine under Article 83 against a controller or processor that was certified to the relevant certification body and the competent supervisory authority that has accredited the relevant certification body."Justification
RISK-BASED APPROACH #12: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
Part of a package. Overall increased simplification and privacy.
#1306 Article 43a (Article 3 – paragraph 1 – point 10 c (new))
Authored by
Regulation (EU) 2016/679
Article 43a
Present text
No equivalentAmendment
10c. The following article is inserted: "Article 43a Common templates and common methodologies 1. The Board may prepare and transmit to the Commission a proposal for a list of situations which clearly are or are not subject to the requirement described in Articles 27(2), 33(1), 34(1) and (3), 35(1) and (3), and 37(1)(b) and (c). 2. The Board may prepare and transmit to the Commission a proposal for a common template and a common methodology for providing information or conducting assessments under Articles 13, 14, 24, 25, 30 and 32 to 36. 3. The proposals for the lists referred to in paragraphs 41 and for the templates and methodologies referred to in paragraph 62 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2). 4. The lists and the templates and methodolog referred to in paragraph 3 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 3. 5. Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Commission adopts the implementing act referred to in paragraph 3."Justification
The amendment turns GDPR harmonisation into practical compliance relief by enabling EU-level black and white lists, templates and methodologies for recurring duties such as DPIAs, breach notifications, transparency information, records and accountability measures. This reduces divergent national expectations, duplicated assessments and over-compliance for cross-border controllers. EDPB preparation preserves expertise, Commission implementing acts provide legal certainty, and regular reviews keep the tools adaptable.
noyb's comment:
Templates make application of the law simpler. The fact that only situations which do not fall under the relevant Articles are codified would typcially overall lead to the lowering of standards.
#1307 Article 44 – paragraphs 1, 1a, 1b (new) (Article 3 – paragraph 1 – point 10 d (new))
Authored by
Regulation (EU) 2016/679
Article 44 – paragraphs 1, 1a, 1b (new)
Present text
1. Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.Amendment
10d. In Article 44, the first paragraph is amended and the following paragraphs 1a and 1b are inserted: "1. Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the standard of the protection provided for data subjects with regard to general processing of personal data in the third country or by the international organisation is not materially lower than the standard of the protection provided for data subjects by this Regulation. 1a. In order to ensure a coherent and proportionate application of this Regulation, the assessment of safeguards for transfers of personal data to third countries should take into account the risk-based approach applicable under Articles 24 and 32, including the nature, scope, context and purposes of the processing, as well as the technical and organisational measures implemented by controllers and processors. Such assessment should not affect the requirement that data subjects whose personal data are transferred to third countries continue to benefit from a level of protection of fundamental rights and freedoms essentially equivalent to that guaranteed within the Union, in accordance with the Charter of Fundamental Rights of the European Union and the case law of the Court of Justice of the European Union. 1b. To support efficient data transfers within multinational corporate groups, supervisory authorities should take into account whether companies apply common internal data protection, security and compliance standards across the group. Where a group has binding internal rules, effective safeguards, and mechanisms to protect data subjects’ rights and remedies, this may create a rebuttable presumption that appropriate safeguards under Article 46 are met. Such presumption should not reduce the level of protection guaranteed under this Regulation, the Charter of Fundamental Rights of the European Union, or the case law of the Court of Justice of the European Union, including regarding access to data by public authorities in third countries."Justification
The amendments support necessary cross-border data flows for EU companies in global value chains, cloud services and multinational groups. Transfer assessments must remain aligned with the Charter and CJEU case law, but should apply a risk-based and proportionate assessment of the safeguards actually used. Where groups apply binding internal rules, common security standards and effective remedies, a rebuttable presumption under Article 46 can reduce formalism without lowering protection or ignoring public-authority access risks.
noyb's comment:
The proposed additions contradict themselves, by proposing a "not materially lower" stardard of protection in paragraph 1 and then "essentially equivalent level of protection" in paragraph 1a. The proposed rebuttable presumption of compliance with the safeguards of Article 46 does not include contestability rights for data subjects.
#1308 Article 45 (Article 3 – paragraph 1 – point 10 e (new))
Authored by
Regulation (EU) 2016/679
Article 45
Present text
1. A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. 2. Such a transfer shall not require any specific authorisation.When assessing the adequacy of the level of protection, the Commission shall, in particular, take account of the following elements: (a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred; (b) the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with the data protection rules, including adequate enforcement powers, for assisting and advising the data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and (c) the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data. 3. The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. 4The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2). 4. The Commission shall, on an ongoing basis, monitor developments in third countries and international organisations that could affect the functioning of decisions adopted pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC. 5. The Commission shall, where available information reveals, in particular following the review referred to in paragraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or an international organisation no longer ensures an adequate level of protection within the meaning of paragraph 2 of this Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by means of implementing acts without retro-active effect. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). On duly justified imperative grounds of urgency, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 93(3). 6. The Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation giving rise to the decision made pursuant to paragraph 5. 7. A decision pursuant to paragraph 5 of this Article is without prejudice to transfers of personal data to the third country, a territory or one or more specified sectors within that third country, or the international organisation in question pursuant to Articles 46 to 49. 8. The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that an adequate level of protection is or is no longer ensured. 9. Decisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article.Amendment
10e. Article 45 replaced by the following: "Article 45 Transfers on the basis of an adequacy decision 1. A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures standard of protection which is not materially lower than the standard provided by this Regulation. Such a transfer shall not require any specific authorisation. 2. Such a transfer shall not require any specific authorisation. When assessing the standard of protection, the Commission shall, in particular, take account of the following elements: (a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred; (b) the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with the data protection rules, including adequate enforcement powers, for assisting and advising the data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and (c) the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data. 3. The Commission, after assessing the standard of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an approved standard of protection within the meaning of paragraph 1 and 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2). 4. The Commission shall, on an ongoing basis, monitor developments in third countries and international organisations that could affect the functioning of decisions adopted pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC. 5. The Commission shall, where available information reveals, in particular following the review referred to in paragraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or an international organisation no longer ensures an sufficient level of protection within the meaning of paragraph 1 and 2 of this Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by means of implementing acts without retro-active effect. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). 6. The Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation giving rise to the decision made pursuant to paragraph 5. 7. A decision pursuant to paragraph 5 of this Article is without prejudice to transfers of personal data to the third country, a territory or one or more specified sectors within that third country, or the international organisation in question pursuant to Articles 46 to 49. 8. The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that the approved level of protection is or is no longer ensured. 9. Decisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article."Justification
The amendments support necessary cross-border data flows for EU companies in global value chains, cloud services and multinational groups. Transfer assessments must remain aligned with the Charter and CJEU case law, but should apply a risk-based and proportionate assessment of the safeguards actually used. Where groups apply binding internal rules, common security standards and effective remedies, a rebuttable presumption under Article 46 can reduce formalism without lowering protection or ignoring public-authority access risks.
noyb's comment:
As with the previous amendment, the essentially equivalent level of protection is proposed to be undermined to "not materially lower than the standard of the Regulation". Additionally, the option for the Commission to urgently adopt implementing acts is proposed to be removed, which could jeopardise the level of protection of the data subjects in urgent situations, that might require the suspension/amendment or repealing of an implementing act. In light of the "Schrems" decisions, this would also likely violate the Charter.
#1309 Article 49 – paragraph 1 (Article 3 – paragraph 1 – point 10 f (new))
Authored by
Regulation (EU) 2016/679
Article 49 – paragraph 1
Present text
Article 49 Derogations for specific situations 1. In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:Amendment
10f. In Article 49, the first paragraph is ammended: "Article 49 Derogations for specific situations 1. In the absence of a decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:"Justification
The amendments support necessary cross-border data flows for EU companies in global value chains, cloud services and multinational groups. Transfer assessments must remain aligned with the Charter and CJEU case law, but should apply a risk-based and proportionate assessment of the safeguards actually used. Where groups apply binding internal rules, common security standards and effective remedies, a rebuttable presumption under Article 46 can reduce formalism without lowering protection or ignoring public-authority access risks.
noyb's comment:
This proposal undermines the level of protection that is currently enshrined in the GDPR and the CFREU.
#1311 Article 57 – paragraph 1 – subparagraph (Article 3 – paragraph 1 – point 11 – introductory part)
Authored by
Regulation (EU) 2016/679
Article 57 – paragraph 1 – subparagraph
Text proposed by the Commission
11. In Article 57(1) is amended as follows:Amendment
11. In Article 57, paragraph 1 is amended as follows: In paragraph 1, the following subparagraph is added: 'National supervisory authorities shall refrain from adopting guidelines, recommendations and best practices on matters already covered by guidelines, recommendations and best practices issued by the Board and, where necessary, shall update or repeal their national documentation adopted prior to guidelines, recommendations and best practices adopted by the Board in order to ensure consistency of interpretation of this Regulation.'
#1312 Article 57 – paragraph 1 – point aa (new) (Article 3 – paragraph 1 – point 11 – point a a (new))
Authored by
Regulation (EU) 2016/679
Article 57 – paragraph 1 – point aa (new)
Text proposed by the Commission
Amendment
(aa) In Article 57, paragraph 1, the following point aa is inserted: '(aa) handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80 and investigate, in the case of a complaint by a data subject at its discretion, to the extent approriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisor authority is necessary;'
noyb's comment:
The amendment gives more discretion to supervisory authorities, which could lead to less complaint handling. The lack of a remedy (beyond civil courts) could violate Article 8(3) and 47 of the Charter.
#1313 Article 57 – paragraph 1 – point d (Article 3 – paragraph 1 – point 11 – point a a (new))
Authored by
Regulation (EU) 2016/679
Article 57 – paragraph 1 – point d
Present text
promote the awareness of controllers and processors of their obligations under this Regulation;Amendment
(aa) In Article 57, paragraph 1, point d is amended as follows: "(d) promote the awareness of controllers and processors of their obligations under this Regulation, and in doing so due regard is given to the principle of proportionality, taking into account the nature, scope, context, risk, and purposes of the processing, while coordinating, where applicable, with the relevant competent sectoral authorities."Justification
INNOVATION PACKAGE #2: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
While it reflects a risk-based approach, the amendment does not directly impact controllers or data subjects.
#1314 Article 57 – paragraph 1 – va (Article 3 – paragraph 1 – point 11 – point a b (new))
Authored by
Regulation (EU) 2016/679
Article 57 – paragraph 1 – va
Text proposed by the Commission
Amendment
(ab) In Article 57, paragraph 1, the following point va is added: '(va) set up regulatory sandboxes to facilitate testing the compliance of specific techniques or technological solutions to be used for the data processing activities with the obligations under this Regulation or whether the data processing results in data that would be exempt from this Regulation.'
noyb's comment:
The amendment provides for compliance tools to be put in place by the supervisory authorities, ultimately shifting compliance to them. The fact that a full excemption from the Regulation is granted would undermine the rights under the GDPR.
#1315 Article 57 – paragraph 1 – point f (Article 3 – paragraph 1 – point 11 – point a b (new))
Authored by
Regulation (EU) 2016/679
Article 57 – paragraph 1 – point f
Present text
handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;Amendment
(ab) In Article 57, paragraph 1, point f is amended: "(f) in handling complaints, the supervisory authority may determine the order of priority according to the seriousness of the alleged infringement and its impact on the rights of data subjects, and may allocate its investigative resources accordingly, provided that each complaint is handled with due diligence;"Justification
INNOVATION PACKAGE #3: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
The amendmentincreases the discretion of supervisory authorities to set their priorities. It would likely be read to allow to ignore many complaints.
#1316 Article 57 – paragraph 2 (Article 3 – paragraph 1 – point 11 a (new))
Authored by
Regulation (EU) 2016/679
Article 57 – paragraph 2
Present text
2. Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.Amendment
11a. In Article 57, paragraph 2 is amended as follows: "2. Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form. Supervisory authority may establish the mandatory use of electronical forms and set up conditions for other means of communication in exceptional cases."Justification
INNOVATION PACKAGE #4: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
The amendment excludes other means of communication with the supervisory authorities, however this could simplify processnig of complaints. Some Member States already have such limitations in national law or practice.
#1317 Article 57 – paragraphs 4a, 4b, 4c (new) (Article 3 – paragraph 1 – point 11 b (new))
Authored by
Regulation (EU) 2016/679
Article 57 – paragraphs 4a, 4b, 4c (new)
Present text
No equivalentAmendment
11b. In Article 57, the following paragraphs are added: "4a. In fullfilling their tasks supervisory authorities shall take into account that the right to the protection of personal data is not an absolute right and must be considered in relation to its function in society and balanced against other fundamental rights, in accordance with the principle of proportionality. They must have inter alia regard of the following as far as relevant in the specific circumstances: (a) the desirability of promoting innovation; (b) the desirability of promoting competition; (c) the importance of the prevention, investigation, detection and prosecution of criminal offences; (d) the need to safeguard public security and national security; (e) the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing. 4b. Supervisory authorities shall, where appropriate, consult and cooperate on national and Union as well as in appropriate cross-border procedures with other regulatory bodies, whose regulatory tasks and powers might are related to the protection of personal data and the free flow of personal data within the Union. When consulting those and cooperating with those other regualtory bodies supervisory authorities praticularly shall take into account the matters according to paragraph 5. The Commission may adopt, by means of an implementing act, procedural rules for the sharing of personal data, business secrets, purpose limititation and other procedural aspects necessary to ensure professional secrecy. 4c. Supervisory authority shall establish a permanent panel of stakeholder representatives to ensure that they fulfill their tasks, especially regarding the matters described in paragraph 4 duely and monitor relevant developments, insofar as they have an impact on the protection of personal data and the free flow of personal data, in particular the development of information and communication technologies and commercial practices. The Commission may adopt, by means of an implementing act, rules for the appointement and the statue oft he members oft he panel and procedural requirements which ensure professional secrecy and transparency."Justification
INNOVATION PACKAGE #5: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
The amendment provides for a balancing test that is not in favor of privacy, for stakeholders bodies that impair the supervisory authorities' independence and for new implementing acts that could lead to uncertainty.
#1318 Article 58 – paragraph 2a (new) (Article 3 – paragraph 1 – point 11 c (new))
Authored by
Regulation (EU) 2016/679
Article 58 – paragraph 2a (new)
Present text
No equivalentAmendment
11c. In Article 58 the following paragraph 2a is added: "(2a) When deciding whether and which of the corrective powers referred to in paragraph 2 to exercise, the supervisory authority shall act according to its dutiful discretion, having regard to the criteria listed in Article 83(2), to the effective protection of the data subject and to the efficient use of its resources. It may refrain from exercising a corrective power where the infringement is minor or has been remedied and its exercise is not necessary to ensure compliance with this Regulation. The obligation to ensure that infringements are brought to an end remains unaffected."Justification
INNOVATION PACKAGE #6: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
Less protection and compliance due to less excercise of corrective powers.
#1320 Article 70 – paragraph 1 – point e (Article 3 – paragraph 1 – point 12 a (new))
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point e
Present text
(e) examine, on its own initiative, on request of one of its members or on request of the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation;Amendment
12a. In Article 70, paragraph 1, point e is amendend as follows: "(e) examine, on its own initiative, on request of one of its members or on request of the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation; in doing so, the Board shall ensure that such guidance: i. remains consistent with the wording, scope, objectives, and risk-based structure of this Regulation, ii. respects the principles of proportionality and legal certainty and does not introduce substantive obligations beyond those laid down in Union law, iii. is accompanied by a published legal assessment confirming its legal basis, feasibility, and conformity with the principles of this Regulation, iv. where applicable, informed by, and coordinated with relevant competent sectoral authorities."Justification
INNOVATION PACKAGE #7: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
This proposal adds to the administrative workload of the EDPB and adds to uncertainty when documents produced by the EDPB do not clearly follow all these vague requirements. The amendment also apparently aims at lowering the level of data protection by emphasising an allege "risk-based" structure of the GDPR (which does not apply to the whole GDPR) and the fact that no further obligations should be introduced.
#1326 Article 70 – paragraph 1 – point ha (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point ha
Text proposed by the Commission
(ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35.Amendment
(ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment, pursuant to Article 35.
noyb's comment:
On its own, this amendment has no significant impact. Clear lists simplify the application of the law.
#1331 Article 70 – paragraph 1 – point hb (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hb
Text proposed by the Commission
(hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.Amendment
(hb) establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.
noyb's comment:
This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.
#1333 Article 70 – paragraph 1 – point hc (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc
Text proposed by the Commission
(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33Amendment
(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33 and a list of the circumstances in which it is not likely to result in a high risk.
noyb's comment:
This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. In addtion, it adds another list, providing fo additional guidance.
#1335 Article 70 – paragraph 1 – point hc (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc
Text proposed by the Commission
(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33Amendment
(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely and not likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33
noyb's comment:
This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear lists simplify the application of the law.
#1336 Article 70 – paragraph 1 – point hc (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc
Text proposed by the Commission
(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33Amendment
(hc) establish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33
noyb's comment:
This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.
#1345 Article 83 – paragraph 5a (new) (Article 3 – paragraph 1 – point 14 a (new))
Authored by
Regulation (EU) 2016/679
Article 83 – paragraph 5a (new)
Present text
No equivalentAmendment
14a. Article 83 is amended by adding the following paragraph 5a: "5a. By derogation from paragraph 4, 5 and 6, small controllers shall be subject to administrative fines of up to 50 000 EUR."Justification
RISK-BASED APPROACH #13: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
Lower fines would lead to more small controllers taking the risk of a small fine; therefore, practically reducing the level of data protection.
#1347 Article 71 – paragraph 2a (new) (Article 3 – paragraph 1 – point 14 b (new))
Authored by
Regulation (EU) 2016/679
Article 71 – paragraph 2a (new)
Present text
Article 71 ReportsAmendment
14b. In Article 71, the title is amended and the follow paragraph 2a is added: "Article 71 Reports, Data Protection Data Space 2a. The Board ensures public access to supervisory authorities‘ activity reports according to Article 59. The Board establishes a Data Protection Data Space which contains in electrionacally usable format: a) the reports published according to Paragraph 1 and Article 59; b) relevant decisions of supervisory authorties in national and cross border cases; c) statistical informations provided by the supervisory authorities about data breach notifictions and complaints; d) guidelines an other public available advise to raise awareness and support the coherent application of this Regulation, regardless wether published by the Board or supervisory authorities. The Commission may adopt, by means of an implementing act, rules which ensures access to the data base for research purposes, guardrails ensuring data protection and professional secrecy, purpose limitation and conditions for the secondary use of the data contained in the Data Protection Data Space."Justification
INNOVATION PACKAGE #8: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
This amendment itself would not significantly affect the level of privacy. But the Clarity provided could lead to some simplification.
#1352 Article 77 – paragraph 2 (Article 3 – paragraph 1 – point 14 c (new))
Authored by
Regulation (EU) 2016/679
Article 77 – paragraph 2
Present text
2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.Amendment
14c. In Article 77, paragraph 2 is replaced by the following: "2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78. Where the controller has appointed a data protection officer in accordance with Article 37, a complaint to the supervisory authority shall be admissible only if the data subject has previously lodged the complaint with the controller or the processor and the latter has not addressed the complaint, or has not fully addressed it, within one month of receiving the complaint."Justification
DPO Package #4: The amendment strengthens accountability by recognising DPOs as practical governance safeguards and first points of contact for complaints. DPOs already advise controllers and processors, monitor compliance and support data subjects; giving them an explicit complaint-handling role makes resolution faster, less bureaucratic and closer to the facts. Voluntary or shared DPOs are encouraged. Supervisory authorities remain available where the complaint is not addressed or not fully remedied within one month.
noyb's comment:
The Amendment limits access to the Supervisory Authority. DPOs are also not meant to be "complaint handling bodies" within the controller (see tasks in Article 39(1) GDPR), but mainly act as independent watchdogs. The additional steps and durations would make the process less simple, especially in urgent cases (e.g. urgent deletion of unlawful content online).
#1353 Article 80 – paragraphs 1 and 2 (Article 3 – paragraph 1 – point 14 d (new))
Authored by
Regulation (EU) 2016/679
Article 80 – paragraphs 1 and 2
Present text
Article 80 Representation of data subjects 1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law. 2. Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject's mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.Amendment
14d. In Article 80, paragraphs 1 and 2 are replaced by the following: "Article 80 Representation of data subjects 1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77 and 78 and the right referred to in Article 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law, with the exception of the right to claim compensation and liability under Article 82. 2. Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject's mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the right referred to in Article 78 and 79, with the exception of the right to claim compensation and liability under Article 82, if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing."Justification
The amendment preserves representative complaints and judicial remedies while clarifying that compensation under Article 82 remains a personal claim requiring proven damage. Non-material damage should be compensable where the infringement causes a significant impairment, ensuring effective redress without turning minor or purely formal infringements into mass claims. This protects data subjects’ individual rights, legal certainty for controllers and processors, and a proportionate balance between enforcement and liability.
noyb's comment:
The amendment excludes representation of the data subjects for enforcing the right to compensation. This Amendment is in conflict with the collective redress directive.
#1356 Article 82 (Article 3 – paragraph 1 – point 14 e (new))
Authored by
Regulation (EU) 2016/679
Article 82
Present text
Article 82 Right to compensation and liability 1. Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.Amendment
14e. In Article 82, the first paragraph is replaced by the following: "Article 82 Right to compensation and liability 1. Any data subject who has suffered proven material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered. A claim for compensation for non-material damage arises only in the event of a significant impairment."Justification
The amendment preserves representative complaints and judicial remedies while clarifying that compensation under Article 82 remains a personal claim requiring proven damage. Non-material damage should be compensable where the infringement causes a significant impairment, ensuring effective redress without turning minor or purely formal infringements into mass claims. This protects data subjects’ individual rights, legal certainty for controllers and processors, and a proportionate balance between enforcement and liability.
noyb's comment:
The amendment restricts the scope of the right to compensation.
#1357 Article 70 – paragraphs 4a, 4b (new) (Article 3 – paragraph 1 – point 14 f (new))
Authored by
Regulation (EU) 2016/679
Article 70 – paragraphs 4a, 4b (new)
Text proposed by the Commission
Amendment
14f. In Article 70, paragraphs 4a and 4b are added: "4a. In fullfilling ist tasks the Board takes into account that the right to the protection of personal data is not an absolute right and must be considered in relation to its function in society and balanced against other fundamental rights, in accordance with the principle of proportionality. The Board must have inter alia regard of the following as far as relevant in the specific circumstances: (a) the desirability of promoting innovation; (b) the desirability of promoting competition; (c) the importance of the prevention, investigation, detection and prosecution of criminal offences; (d) the need to safeguard public security and national security; (e) the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing. 4b. The Board shall establish a permanent panel of stakeholder representatives to ensure that it fulfills its tasks, especially regarding the matters described in paragraph 5 duely and monitor relevant developments, insofar as they have an impact on the protection of personal data and the free flow of personal dada, in particular the development of information and communication technologies and commercial practices. The Commission may adopt, by means of an implementing act, rules for the appointement and the statue oft he members oft he panel and procedural requirements which ensure professional secrecy and transparency. "Justification
INNOVATION PACKAGE #8: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
This amendment highlights (and therefore pushes) the limits to data protection, effectively lowering the level of data protection. At the same time, these considerations do not provide for any significant simplification.
#1362 Article 88a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a
Text proposed by the Commission
Article 88aAmendment
deleted
#1370 Article 88a – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 1
Text proposed by the Commission
(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.Amendment
(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject, and any subsequent processing necessary to achieve the purpose for which the data subject has given consent is only allowed when that person has given his or her consent, in accordance with this Regulation.
noyb's comment:
Unclear versus the current situation with the ePrivacy Directive given the confusing terminology, better than the Commission proposal.
#1371 Article 88a – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 1
Text proposed by the Commission
(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.Amendment
(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person shall be lawful where such processing is carried out in accordance with this Regulation and on the basis of Article 6 of this Regulation.
#1374 Article 88a – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 2
Text proposed by the Commission
(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).Amendment
deleted
noyb's comment:
Back to the current legal framework, which already foresees Article 23 GDPR. Not much change.
#1379 Article 88a – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 2
Text proposed by the Commission
(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).Amendment
(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).
#1383 Article 88a – paragraph 3 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3
Text proposed by the Commission
(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:Amendment
(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
#1384 Article 88a – paragraph 3 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3
Text proposed by the Commission
(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:Amendment
(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful for any of the following:
#1385 Article 88a – paragraph 3 – point aa (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point aa (new)
Text proposed by the Commission
Amendment
(aa) In Article 88a, paragraph 3, the following point aa is inserted: '(aa) enabling contextual advertising to the user, and related purposes which support contextual advertising, which is not based on any type of profiling.'
#1387 Article 88a – paragraph 3 – point b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point b
Text proposed by the Commission
(b) providing a service explicitly requested by the data subject;Amendment
(b) providing a service or the maintenance of a user session explicitly requested by the data subject;
noyb's comment:
Broadens the exception and does not provide additional legal certainty, given that a user session can be used for many different purposes (from necessary elements to ads).
#1390 Article 88a – paragraph 3 – point c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c
Text proposed by the Commission
(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;Amendment
(c) measuring the audience of an online service in order to draw aggregated information about the usage of an online service to measure the audience of such a service, as defined by article 2 (16) of Regulation 2024/1083, where it is carried out by the controller of that online service solely for its own use or by entitled third parties jointly authorised by advertisers and publishers, solely for the measurement of the overall market performance and subject to the safeguards laid down in Article 89(1);
noyb's comment:
Compared to the current legal framework, a new exception that relies on the Commission proposal, even if more limited that the Commission proposal.
#1393 Article 88a – paragraph 3 – point c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c
Text proposed by the Commission
(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;Amendment
(c) creating information about the usage of an online service solely for the use of the provider of that service;
noyb's comment:
Broadens the new exception proposed. No need to aggregate/anonymize the data.
#1394 Article 88a – paragraph 3 – point c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c
Text proposed by the Commission
(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;Amendment
(c) (c) creating information about the usage of an online service to measure the audience of such a service, where it is carried out at the direction of the controller of that online service, or by a third party acting on behalf of the controller;
#1395 Article 88a – paragraph 3 – point c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c
Text proposed by the Commission
(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;Amendment
(c) measure the audience as defined in article 2(16) of Regulation 2024/1083, where it is carried out by the provider of that online service, or by a joint controller or processor mandated by the provider of that online service;Justification
This amendment ensures legal clarity by aligning the text with the EMFA definition of audience measurement and allowing mandated joint controllers or processors to carry it out. This safeguards independent, comparable and verifiable measurement, while enabling the use of aggregated market statistics for transparency and fair competition.
noyb's comment:
Limits the exception, but compared to current law still an additional exception.
#1396 Article 88a – paragraph 3 – point c (Article 3 – paragraph 1 – point 15)
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c
Text proposed by the Commission
(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;Amendment
(c) measuring the audience of an online service, where it is carried out by the controller of that online service solely for its own use, or by a third party acting on behalf of the controller;
#1397 Article 88a – paragraph 3 – point ca (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point ca (new)
Text proposed by the Commission
Amendment
(ca) In Article 83, paragraph 3, the following point ca is inserted: '(ca) performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083.'
noyb's comment:
New exception to the rule. Also, wronlgy refers to Article 83 instead of 88.
#1398 Article 88a – paragraph 3 – point d (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point d
Text proposed by the Commission
(d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.Amendment
(d) maintaining or restoring the security, integrity and functioning of a service provided by the controller and requested by the data subject or the security of the terminal equipment used for the provision of such service, including detecting, preventing or mitigating fraud, automated or non-human traffic, unauthorised access, misuse of the service, circumvention of technical access conditions, or other uses that are contrary to the provider’s terms and conditions
noyb's comment:
Broadens the exception and makes the interpretation of the law subject to private terms and conditions, allowing to enforce them via accesst to other's PCs, smart phones or servers. Likely to go beyond any proportinality under Article 7 and 8 of the Charter.
#1399 Article 88a – paragraph 3 – point d (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point d
Text proposed by the Commission
(d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.Amendment
(d) maintaining, restoring or ensuring the technical security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service, including in particular cybersecurity, the protection of personal data and privacy of the user and prevention of fraud and unauthorised access provided that such measures do not override the fundamental rights and interests of the subscriber or user;
noyb's comment:
Builds upon the new exception proposed by the Commission, which allows for a limitation on privacy. Yet, slightly pushing back on the Commission proposal.
#1401 Article 88a – paragraph 3 – point d (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point d
Text proposed by the Commission
(d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.Amendment
(d) maintaining or restoring the security and integrity of a service provided by the controller, including fraud prevention or technical incidents, of the terminal equipment used for the provision of such service.
#1403 Article 88a – paragraph 3 – point da (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)
Text proposed by the Commission
Amendment
(da) In Article 88a, paragraph 3, the following point da is added: '(da) contextual advertising and related limitation of advertisement display, audience measurement and preventing fraudulent misrepresentation of audience, unless at least one of the following applies: (i) the processing is likely to result in a risk to the rights and freedoms of natural persons; (ii) the processing involves profiling; (iii) personal data are stored at the time when the electronic communication service is not actively used; (iv) personal data are connected with past or future activity of the data subject.'
noyb's comment:
New exception, many (partly undefined) details to consider as a controller. Lack of legal certainty.
#1405 Article 88a – paragraph 3 – point da (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)
Text proposed by the Commission
Amendment
(da) In Article 88a, paragraph 3, the following point da is added: '(da) ‘legitimate interests’ according to Article 6(1)(f) of this regulation provided that the controller applies Privacy Enhancing Technologies (PETs) in accordance with the technical standards adopted pursuant to Article 25a. This point shall not apply to processing operations that involve tracking or profiling a data subject's behaviour for the purposes of behavioural advertising, where the advertising itself is directly generating revenue for the controller, or where there is no direct relationship with the data subject.'
noyb's comment:
New exception introduced. Very vague, mixing different concepts (personal data, legitimate interest and PETs).
#1406 Article 88a – paragraph 3 – point da (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)
Text proposed by the Commission
Amendment
(da) In Article 88a, paragraph 3, the following point da is added: '(da) legitimate purposes in relation to contextual advertising, including measuring the performance and reach of such advertisement or capping the frequency with which such advertisement is being displayed.'
#1408 Article 88a – paragraph 3 – point da (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)
Text proposed by the Commission
Amendment
(da) In Article 88a, paragraph 3, the following point da is added: '(da) processing where the controller deploys recognised Privacy Enhancing Technologies (PETs) that effectively mitigate risks associated to the processing of personal data.'
noyb's comment:
New very broad exception introduced. Vague, given that PETs are not defined and often amount to "privacy washing".
#1409 Article 88a – paragraph 3 – point da (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)
Text proposed by the Commission
Amendment
(da) In Article 88a, paragraph 3, the following point da is added: '(da) carrying out operations to detect, prevent or mitigate fraud and money laundering, as well as to combat the financing of terrorism;'
noyb's comment:
New exception that belongs to national security and would usually be regulated in national law. Allows (but does not oblige) private entities to monitor money laundering through cookies and similar technologies.
#1410 Article 88a – paragraph 3 – point db (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point db
Text proposed by the Commission
Amendment
(db) In Article 88a, paragraph 3, the following point db is added: '(db) ‘legitimate interests’ according to Article 6(1)(f) of this regulation provided that the controller applies Privacy Enhancing Technologies (PETs) in accordance with the technical standards adopted pursuant to Article 25a. This point shall not apply to processing operations that involve tracking or profiling a data subject's behaviour for the purposes of behavioural advertising, regardless of whether there is a direct relationship with the data subject. This does not preclude the processing of data for internal product optimisation, provided such processing is not used to track the user.'
noyb's comment:
New exception introduced. Very vague, mixing different concepts (personal data, legitimate interest and PETs).
#1411 Article 88a – paragraph 3 – point db (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point db (new)
Text proposed by the Commission
Amendment
(db) In Article 88a, paragraph 3, the following point db is inserted: '(db) processing where the controller deploys recognised privacy-enhancing technologies (PETs) that effectively mitigate risks to the rights and freedoms of data subjects, in accordance with the technical specifications adopted pursuant to paragraph 4, 5 and 6;'
noyb's comment:
New very broad exception introduced. Vague, given that PETs often amount to "privacy washing".
#1412 Article 88a – paragraph 3 – point db (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point db (new)
Text proposed by the Commission
Amendment
(db) In Article 88a, paragraph 3, the following point db is added: '(db) performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083.'
#1413 Article 88a – paragraph 3– point dc (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3– point dc (new)
Text proposed by the Commission
Amendment
(dc) In Article 88a, paragraph 3, the following point dc is added: '(dc) For the purpose of Article 88a paragraph (3)(e), the Commission shall: (i) assess the state of the art of available technologies; (ii) develop criteria to assess the effectiveness of risk mitigation in relation to the specific categories of data and processing operations.'
noyb's comment:
Related to new exception, risk assessment oursourced to Commission, which may conflict with Article 8(3) of the Charter. Lack of legal certainty under the law (criteria developed outside of the law).
#1415 Article 88a – paragraph 3a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3a (new)
Text proposed by the Commission
Amendment
(3a) In Article 88a, the following paragraph 3a is added: '3a. For any other purpose than those referred to in the second subparagraph, the processing shall comply with Article 6 and, where applicable, with Article 9.'
noyb's comment:
Basically allows more legal basis (Article 88a + 6 and 9) for the access to other people's smart phones, PCs or servers. May go beyond what the CJEU would accept under Article 7 of the Charter. Consistency between ePrivacy and GDPR would however be "simpler".
#1420 Article 88a – paragraph 4 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4
Text proposed by the Commission
(4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.Amendment
deleted
noyb's comment:
Removes clearer rules on the design of consent requests. Maintains more legal uncertainty.
#1424 Article 88a – paragraph 4 – introductory sentence (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4 – introductory sentence
Text proposed by the Commission
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:Amendment
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject is based on consent, the following shall apply:
#1426 Article 88a – paragraph 4 – point a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point a
Text proposed by the Commission
(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;Amendment
(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means, except where the controller is a media service provider as defined in Article 2 (2) of Regulation (EU) 2024/108
noyb's comment:
Waters down clearer rules for user options and makes the nature of consent absurd in cases of media service providers. Overall leads to a more complex landscape. Questionable from an equality before the law perspective.
#1427 Article 88a – paragraph 4 – point a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point a
Text proposed by the Commission
(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;Amendment
(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner, or be presented with the option to decline consent and proceed to a paid alternative;
#1429 Article 88a – paragraph 4 – point a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point a
Text proposed by the Commission
(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;Amendment
(a) the data subject shall be able to refuse or accept requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
noyb's comment:
Legally establishes that the treatment of the refuse and the accept option are equivalent.
#1431 Article 88a – paragraph 4 – point b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point b
Text proposed by the Commission
(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;Amendment
(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully or technically rely on the consent of the data subject;
noyb's comment:
Allows for artificially limiting the period for which consent is technically valid. Then rerequesting is possible.
#1432 Article 88a – paragraph 4 – point c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c
Text proposed by the Commission
(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.Amendment
deleted
#1435 Article 88a – paragraph 4 – point c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c
Text proposed by the Commission
(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.Amendment
(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months unless a substantial change in circumstances, in the purposes of the processing or in the safeguards afforded to the data subject justifies a new request.
#1436 Article 88a – paragraph 4 – point c (Article 3 – paragraph 1 – point 15)
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c
Text proposed by the Commission
(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.Amendment
(c) Where data subject refuse request for consent presented by media service providers, Media service providers shall be able to offer data subjects an equivalent alternative that is not accompanied by the processing of personal data for audience-based advertising purposes, where appropriate for a reasonable fee.
noyb's comment:
Limits the proposal of the Commission to media service providers and rewrites it to introduce payment for refusing consent, but is unclear about the details. Questionable from an equality before the law perspective.
#1437 Article 88a – paragraph 4 – point c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c
Text proposed by the Commission
(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.Amendment
(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months, except where the controller is a media service provider as defined in Article 2 (2) of Regulation (EU) 2024/108.
noyb's comment:
Limits the Commission proposal in case of media providers. Questionable from an equality before the law perspective.
#1441 Article 88a – paragraph 4a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4a (new)
Text proposed by the Commission
Amendment
(4a) In Article 88a, the following paragraph 4a is inserted: '4a. Nothing in this Article shall prevent a media service provider from making access to its service conditional on either the data subject's consent to the processing of personal data for one or more specified purposes, or the payment of a reasonable fee for access to an equivalent version that does not involve such processing. Where such is offered, both options shall be presented to the data subject with equal prominence, in plain language and without the use of dark patterns.'
noyb's comment:
Makes refusing consent dependent on a payment. Questionable from an equality before the law perspective.
#1443 Article 88b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b
Text proposed by the Commission
Article 88bAmendment
deleted
#1444 Article 88b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b
Text proposed by the Commission
Article 88bAmendment
deleted
#1445 Article 88b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b
Text proposed by the Commission
Article 88bAmendment
deleted
#1446 Article 88b (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b (new)
Text proposed by the Commission
Article 88bAmendment
deleted
#1447 Article 88b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b
Text proposed by the Commission
Article 88bAmendment
deleted
#1448 Article 88b (Article 3 – paragraph 1 – point 15)
Regulation (EU) 2016/679
Article 88b
Text proposed by the Commission
Article 88bAmendment
deletedJustification
Centralising consent at the browser level risks reinforcing the position of dominant undertakings, in some cases designated as gatekeepers under the Digital Markets Act
#1450 Article 88b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b
Text proposed by the Commission
Article 88bAmendment
deleted (The amendment seeks to delete the whole Article 88b)
#1451 Article 88b – title (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – title
Text proposed by the Commission
Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural personsAmendment
deleted
#1452 Article 88b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b
Text proposed by the Commission
Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural personsAmendment
deleted
#1453 Article 88b – title (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – title
Text proposed by the Commission
Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural personsAmendment
deleted
#1454 Article 88 b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88 b
Text proposed by the Commission
Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural personsAmendment
deleted
#1455 Article 88b – title (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – title
Text proposed by the Commission
Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural personsAmendment
Voluntary automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons
noyb's comment:
Significantly weakens the positive Commission proposal. A voluntary system would be chaotic and hardly functioning (see "DNT").
#1459 Article 88b – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1
Text proposed by the Commission
(1) Controllers shall ensure that their online interfaces allow data subjects to: (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.Amendment
deleted
#1460 Article 88b – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1
Text proposed by the Commission
(1) Controllers shall ensure that their online interfaces allow data subjects to: (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.Amendment
deleted
#1461 Article 88b – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1
Text proposed by the Commission
(1) Controllers shall ensure that their online interfaces allow data subjects to: (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.Amendment
deleted
#1462 Article 88b – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1
Text proposed by the Commission
(1) Controllers shall ensure that their online interfaces allow data subjects to: (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.Amendment
deleted
#1466 Article 88b – paragraph 1 – point a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a
Text proposed by the Commission
(a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;Amendment
deleted
#1467 Article 88b – paragraph 1 – point a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a
Text proposed by the Commission
(a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;Amendment
deleted
#1468 Article 88b – paragraph 1 – point a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a
Text proposed by the Commission
(a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;Amendment
deleted
#1473 Article 88b – paragraph 1 – point b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point b
Text proposed by the Commission
(b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.Amendment
deleted
#1480 Article 88b – paragraph 1 – point ba (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point ba (new)
Text proposed by the Commission
Amendment
(ba) In Article 88b, paragraph 1, the following point ba is inserted: ‘(ba) modify, withdraw or reinstate their consent at any time, and modify their choice concerning the exercise of their right to object, by automated and machine-readable means, under conditions that are as straightforward as those for giving their consent or exercising that right.’
noyb's comment:
Introducing withdrawal and the option to modify changes explicitely.
#1488 Article 88b – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 2
Text proposed by the Commission
(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.Amendment
deleted
#1489 Article 88b – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 2
Text proposed by the Commission
(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.Amendment
deleted
#1490 Article 88b – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 2
Text proposed by the Commission
(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.Amendment
deleted
#1491 Article 88b – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 2
Text proposed by the Commission
(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.Amendment
deleted
#1499 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 3
Text proposed by the Commission
(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.Amendment
deleted
noyb's comment:
Broader application for automated signals, less interruptions for users, unique simpler experience for most interfaces. Exception is questionable from an equality before the law perspective.
#1500 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 3
Text proposed by the Commission
(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.Amendment
deleted
noyb's comment:
Broader application for automated signals, less interruptions for users, unique simpler experience for most interfaces. Exception is questionable from an equality before the law perspective.
#1501 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 3
Text proposed by the Commission
(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.Amendment
deleted
noyb's comment:
Broader application for automated signals, less interruptions for users, unique simpler experience for most interfaces. Exception is questionable from an equality before the law perspective.
#1503 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 3
Text proposed by the Commission
(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.Amendment
deleted
noyb's comment:
Broader application for automated signals, less interruptions for users, unique simpler experience for most interfaces. Exception is questionable from an equality before the law perspective.
#1505 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 3
Text proposed by the Commission
(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.Amendment
(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service. This exemption extends to all processing carried out by or on behalf of a media service provider in connection with the provision of the media service.
#1506 Article 88b – paragraph 3a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 3a (new)
Text proposed by the Commission
Amendment
(3a) In Article 88b, the following paragraph is inserted: '3a. Where a data subject gives specific consent to a controller pursuant to Article 88a, such consent shall prevail over any conflicting automated or machine-readable indication referred to in paragraph 1.'
noyb's comment:
Makes automated signals meaningless as common cookie banners would override them.
#1507 Article 88b – paragraph 4 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4
Text proposed by the Commission
(4) The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.Amendment
deleted
#1508 Article 88b – paragraph 4 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4
Text proposed by the Commission
(4) The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.Amendment
deleted
#1509 Article 88b – paragraph 4 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4
Text proposed by the Commission
(4) The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.Amendment
deleted
#1510 Article 88b – paragraph 4 – first subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph
Text proposed by the Commission
The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices.Amendment
deleted
#1511 Article 88b – paragraph 4 – first subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph
Text proposed by the Commission
The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices.Amendment
deleted
#1512 Article 88b – paragraph 4 – first subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph
Text proposed by the Commission
The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices.Amendment
deleted
#1513 Article 88b – paragraph 4 – first subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph
Text proposed by the Commission
The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices.Amendment
The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. The European standardisation organisations shall, where appropriate, take into account existing international standards developed by international standardisation organisations, as well as emerging technical specifications developed by relevant industry consortia. When drawing up the standardisation mandate, the Commission shall consult the European Data Protection Board and an advisory forum comprising representatives of controllers, data subjects, media service providers, consumer protection organisations, academia and civil society to ensure that standards reflect diverse perspectives and do not create new gatekeepers
noyb's comment:
Positive approach, but should not only rely on specifications developed by industry consortia.
#1519 Article 88b – paragraph 4 – second subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – second subparagraph
Text proposed by the Commission
Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.Amendment
deleted
#1520 Article 88b – paragraph 4 – second subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – second subparagraph
Text proposed by the Commission
Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.Amendment
deleted
#1521 Article 88b – paragraph 4 – second subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – second subparagraph
Text proposed by the Commission
Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.Amendment
deleted
#1525 Article 88b – paragraph 5 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 5
Text proposed by the Commission
(5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].Amendment
deleted
noyb's comment:
Can be read as good for privacy (shortening the time for application) or as negative as a part of deleting the article, given that an implementation in 20 days [when the Article would apply] seems too ambitious.
#1526 Article 88b – paragraph 5 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 5
Text proposed by the Commission
(5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].Amendment
deleted
noyb's comment:
Can be read as good for privacy (shortening the time for application) or as negative as a part of deleting the article, given that an implementation in 20 days [when the Article would apply] seems too ambitious.
#1527 Article 88b – paragraph 5 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 5
Text proposed by the Commission
(5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].Amendment
deleted
noyb's comment:
Can be read as good for privacy (shortening the time for application) or as negative as a part of deleting the article, given that an implementation in 20 days [when the Article would apply] seems too ambitious.
#1528 Article 88b – paragraph 5 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 5
Text proposed by the Commission
(5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].Amendment
deleted
noyb's comment:
Can be read as good for privacy (shortening the time for application) or as negative as a part of deleting the article, given that an implementation in 20 days [when the Article would apply] seems too ambitious.
#1530 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 6
Text proposed by the Commission
(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.Amendment
deleted
#1531 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 6
Text proposed by the Commission
(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.Amendment
deleted
#1532 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 6
Text proposed by the Commission
(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.Amendment
deleted
#1533 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 6
Text proposed by the Commission
(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.Amendment
deleted
#1536 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 6
Text proposed by the Commission
(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.Amendment
(6) Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces that provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article ,and shall provide the technical means to allow media service providers to effectively use the exception pursuant to paragraph 3, as applied pursuant to paragraphs 2 to 5 of this article. The technical means should allow for granular choices, including category-based or purpose-based preferences, and shall enable data subjects to override global settings at the service level.
noyb's comment:
Removes the obligation for providing the technical options.
#1542 Article 88b – paragraph 7 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 7
Text proposed by the Commission
(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].Amendment
deleted
noyb's comment:
Can be read as good for privacy (shortening the time for application) or as negative as a part of deleting the article, given that an implementation in 20 days [when the Article would apply] seems too ambitious.
#1543 Article 88b – paragraph 7 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 7
Text proposed by the Commission
(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].Amendment
deleted
noyb's comment:
Can be read as good for privacy (shortening the time for application) or as negative as a part of deleting the article, given that an implementation in 20 days [when the Article would apply] seems too ambitious.
#1545 Article 88b – paragraph 7 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 7
Text proposed by the Commission
(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].Amendment
deleted
noyb's comment:
Can be read as good for privacy (shortening the time for application) or as negative as a part of deleting the article, given that an implementation in 20 days [when the Article would apply] seems too ambitious.
#1546 Article 88b – paragraph 7 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 7
Text proposed by the Commission
(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].Amendment
deleted
noyb's comment:
Can be read as good for privacy (shortening the time for application) or as negative as a part of deleting the article, given that an implementation in 20 days [when the Article would apply] seems too ambitious.
#1549 Article 88b – paragraph 7a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 7a (new)
Text proposed by the Commission
Amendment
(7a) In Article 88b, the following paragraph is added: '7a. The Commission shall, by [insert date = 3 years after the date of entry into force of this Regulation], submit a report to the European Parliament and the Council on the functioning of this Article, including an assessment of: (a) the impact on user choice and competition; (b) the effectiveness of machine-readable indications in reducing consent fatigue; (c) the emergence of new gatekeeper risks; (d) the impact on European media service providers; and (e) the need for legislative amendment.'
#1550 Article 88b – paragraph 7a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 7a (new)
Text proposed by the Commission
Amendment
(7a) In Article 88b, the following paragrpah is added: '7a. The Commission shall, by [insert date = 3 years after the date of entry into force of this Regulation], submit a report to the European Parliament and the Council on the functioning of this Article, including an assessment of: (a) the impact on user choice and competition; (b) the effectiveness of machine-readable indications in reducing consent fatigue; (c) the emergence of new gatekeeper risks; (d) the impact on European media service providers; and (e) the need for legislative amendment.'
#1561 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 1
Text proposed by the Commission
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Amendment
Where the processing of personal data is necessary for the interests of the controller, or a third party, in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, including a general-purpose AI model as defined in Article 3, point (63) of Regulation (E) 2024/1689, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of this Regulation except where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child and except where other Union explicitly require consent. The processing of personal data in the context of the development and operation of an AI system may also be based for the performance of a task carried out by public authorities in the public interest pursuant to Article 6, paragraph 1, point (e) and paragraph 2.
#1562 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 1
Text proposed by the Commission
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Amendment
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of this Regulation, except where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child and where other Union laws explicitly require consent. The processing of personal data in the context of the development and operation of an AI system may also be based for the performance of a task carried out by public authorities in the public interest pursuant to Article 6, paragraph 1, point (e) and paragraph 2.
#1563 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)
Regulation (EU) 2016/679
Article 88c – paragraph 1
Text proposed by the Commission
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Amendment
1) Where the processing of personal data is necessary for the purposes of the development, training, testing, validation, deployment, operation or monitoring of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or of an AI model, such processing may constitute a legitimate interest within the meaning of Article 6(1), point (f), provided that: (a) the processing is necessary for the interest pursued by the controller or by a third party; (b) that interest is not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, taking particular account of whether the data subject is a child; and (c) no provision of Union or Member State law expressly requires the consent of the data subject for that processing.
noyb's comment:
The provision repeats the existing Article 6(1)(f) GDPR, without adding safeguards.
#1564 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 1
Text proposed by the Commission
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Amendment
Where the processing of personal data is necessary for the interests of the controller or a third party in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, including a general-purpose AI model as defined in Article 3, point (63) Regulation (EU) 2024/1689 such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, except where other Union explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
#1565 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 1
Text proposed by the Commission
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Amendment
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
noyb's comment:
The amendment removes the option for Member States to require consent.
#1566 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 1
Text proposed by the Commission
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Amendment
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data.Justification
Europe needs a clear, harmonised lawful basis for responsible AI development and operation. Divergent interpretations of legitimate interest create uncertainty, compliance costs and incentives to train, test and validate AI outside Europe. The amendment confirms that Article 6(1)(f) may apply where processing is necessary and balanced against data-subject rights, while preserving consent requirements, the duty to choose the correct lawful basis and safeguards against disclosure of residually retained data.
noyb's comment:
The amendment removes the option for Member States to require consent and removes the mention to the rights of children.
#1567 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 1
Text proposed by the Commission
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Amendment
Where the processing of personal data is necessary for the interests of the controller or a third party in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Justification
This amendment aligns Article 88c with the GDPR by recognising the legitimate interests of both controllers and third parties, avoiding unnecessary restrictions on AI supply chains. It removes references that could reintroduce divergent national rules on consent and an "unconditional right to object," which is already governed by Article 21 GDPR. The amendment preserves data protection while improving legal certainty, consistency, and Single Market harmonisation.
noyb's comment:
The amendment rephrases the Commission's proposal and removes the mention of consent required by other laws.
#1570 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 1
Text proposed by the Commission
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Amendment
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679 except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject in accordance with Articles 6 and 21 of this Regulation, in particular where the data subject is a child.
#1573 Article 88c – paragraph 2a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2a (new)
Text proposed by the Commission
Amendment
In Article 88c, the following paragraph is added: '2a. The Commission shall issue guidelines on the assessment of legitimate interests in the context of training and testing of AI systems and AI models.'
noyb's comment:
This proposal leaves the interpretation of Article 6(1)(f) GDPR to the Commission which would be the task of the EDPB. This may also violate Article 8(3) of the Charter.
#1579 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)
Regulation (EU) 2016/679
Article 88c – paragraph 2
Text proposed by the Commission
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.Amendment
2) Where the task or official authority of a public authority or body is laid down by Union or Member State law in accordance with Article 6(3), personal data may be further processed for the purposes referred to in paragraph 1 on the basis of Article 6(1), point (e), where: (a) the development or use of the AI system or AI model serves the performance of that task or the exercise of that official authority; (b) the purpose pursued cannot be effectively achieved by processing non-personal or anonymised data; and (c) the processing is necessary and proportionate to the public interest objective pursued. This paragraph shall not confer any new task or official authority on a public authority or body. 3) Controllers shall use non-personal or anonymised data where the purpose of the processing can reasonably and effectively be achieved by using such data.Where the use of personal data is necessary, controllers shall use pseudonymised data wherever the purpose can reasonably and effectively be achieved by using such data. 4) Processing pursuant to paragraphs 1 and 2 shall be subject to appropriate technical and organisational measures and safeguards for the rights and freedoms of data subjects. Those measures shall include, as appropriate: (a) ensuring data minimisation during the selection of data sources and throughout the training, testing, validation, deployment and operation of the AI system or AI model; (b) limiting the processing to data that are adequate, relevant and necessary for the intended purpose; (c) applying state-of-the-art privacy-enhancing technologies, including pseudonymisation, where appropriate; (d) testing, monitoring and mitigating the risks of memorisation, regurgitation, data leakage, inference and unauthorised disclosure; (e) effectively preventing personal data retained or memorised in the AI system or AI model from being used to generate outputs which disclose or otherwise make those data available to persons not authorised to receive them; (f) ensuring that personal data are included in an output only where such inclusion is necessary for the intended purpose, the recipient is authorised to receive the data and the disclosure has a legal basis under Article 6 and, where applicable, Article 9; (g) providing appropriate transparency to data subjects; and (h) facilitating the exercise of the rights of data subjects under this Regulation. 5) Where the controller cannot effectively prevent the unauthorised disclosure of personal data through the output of the AI system or AI model, the controller shall not deploy or operate that system or model in a manner that enables such disclosure. 6) The processing of special categories of personal data shall be permitted only where one of the conditions laid down in Article 9(2) is fulfilled. Where point (k) of Article 9(2) applies, the conditions and safeguards laid down in Article 9(5) shall apply. 7) Paragraphs 1 to 6 shall be without prejudice to the other provisions of this Regulation, Regulation (EU) 2024/1689 and other applicable Union or Member State law.
noyb's comment:
The proposal allows for "further processing", usually understood as processing beyond the original purpose. While there is a long list of requirements, it is unclear why they would only apply to public tasks.
#1581 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2
Text proposed by the Commission
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.Amendment
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects.Justification
Europe needs a clear, harmonised lawful basis for responsible AI development and operation. Divergent interpretations of legitimate interest create uncertainty, compliance costs and incentives to train, test and validate AI outside Europe. The amendment confirms that Article 6(1)(f) may apply where processing is necessary and balanced against data-subject rights, while preserving consent requirements, the duty to choose the correct lawful basis and safeguards against disclosure of residually retained data.
noyb's comment:
The amendment includes more derogations than the Commission's proposal.
#1583 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2
Text proposed by the Commission
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.Amendment
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data. When assessing the safeguards required, account shall be taken of safeguards already provided for under Union or national law.
noyb's comment:
The amendment repeats the existing proposal, as well as existing GDPR obligations regarding the safeguards required.
#1584 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2
Text proposed by the Commission
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.Amendment
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model.
noyb's comment:
The amendment removes the transparency elements from the Commission's proposal.
#1586 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2
Text proposed by the Commission
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.Amendment
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of an AI system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with right to object to the processing of their personal data in accordance with Article 21 of Regulation (EU) 2016/679.Justification
This amendment aligns Article 88c with the GDPR by recognising the legitimate interests of both controllers and third parties, avoiding unnecessary restrictions on AI supply chains. It removes references that could reintroduce divergent national rules on consent and an "unconditional right to object," which is already governed by Article 21 GDPR. The amendment preserves data protection while improving legal certainty, consistency, and Single Market harmonisation.
noyb's comment:
The amendment pushes against an unconditional right to object.
#1587 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2
Text proposed by the Commission
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.Amendment
Any such processing shall be subject to appropriate organisational, technical and legal measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects.
noyb's comment:
The amendment pushes against the right to object in proposed Article 88c.
#1588 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2
Text proposed by the Commission
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.Amendment
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with a right to object to the processing of their personal data.
noyb's comment:
The amendment pushes against an unconditional right to object.
#1589 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2
Text proposed by the Commission
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.Amendment
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with a right to object to the processing of their personal data.
noyb's comment:
The amendment pushes against an unconditional right to object.
#1590 Article 88d (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88d (new)
Text proposed by the Commission
Amendment
After Article 88c, the following article is inserted: 'Article 88d Processing in the context of the provision of audiovisual media services of general interest Where the processing of personal data, including the storage of or access to personal data already stored in the terminal equipment of a natural person, is necessary for the delivery and audience measurement of both programmes and advertising provided by audiovisual media services of general interest, as referred to in Article 7a of Directive 2010/13/EU, such processing shall be carried out on the basis of legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679. This shall apply except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data, in particular where the data subject is a child. Any such processing shall be subject to appropriate organisational and technical measures, as well as safeguards to protect the rights and freedoms of the data subject. These measures and safeguards shall be set out in a sectoral code of conduct established in accordance with Article 40(2)(b) of Regulation (EU) 2016/679 and approved pursuant to Article 40(5) thereof.'
noyb's comment:
This amendment proposes further AI allowances for audiovisual media services.
#1592 Article 88c – paragraph 2a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2a (new)
Text proposed by the Commission
Amendment
In Article 88c, the following paragraph is added: '2a. This does not affect the obligation of the controller to choose the most appropriate lawful ground of processing set out in Article 6 of Regulation (EU) 2016/679, such as Article 6(1)(e) with regard to processing by public authorities.'Justification
Europe needs a clear, harmonised lawful basis for responsible AI development and operation. Divergent interpretations of legitimate interest create uncertainty, compliance costs and incentives to train, test and validate AI outside Europe. The amendment confirms that Article 6(1)(f) may apply where processing is necessary and balanced against data-subject rights, while preserving consent requirements, the duty to choose the correct lawful basis and safeguards against disclosure of residually retained data.
noyb's comment:
This amendment repeats existing obligations and options for controllers under the GDPR.
#1595 Annex 1a (new) (Article 3 – paragraph 1 – point 15 a (new))
Authored by
Regulation (EU) 2016/679
Annex 1a (new)
Present text
No equivalentAmendment
15a. After Annex 1, the following Annex is added: "ANNEX Ia Legitimate interests within the meaning of point (f) of the first subparagraph of Article 6 paragraph 1 include, but are not restricted to: 1. Legal and Regulatory Compliance a. preventing, detecting or investigating fraud and other criminal activities; b. ensuring workplace safety and security (eg, CCTV monitoring in public areas of the workplace or monitoring premises with sensitive operations); c. conducting audits or compliance checks; d. reporting illegal activities or threats to public safety to authorities; e. cooperating with authorities in situations of emergency. 2. Business Operations and Management a. ensuring the proper functioning of equipment, IT systems or infrastructure; b. ensuring network and information security (eg, preventing unauthorised access or cyberattacks) and preventing misuse of services or systems (eg, detecting bots or spam); c. protecting the controller’s or a third party’s assets, reputation, or intellectual property; d. establishing, exercising, or defending legal claims; e. monitoring business performance or productivity. 3. Research and Development a. conducting scientific or historical research; b. improving products or services (eg, based on customer feedback); c. developing new technologies or services (eg, training, validating or testing of artificial intelligence); d. clinical trials; e. archiving or statistical activities in the public interest. 4. Distribution and Marketing a. ensuring seamless transactions and user experiences on websites or apps; b. maintaining customer records for service continuity; c. conducting market research or customer satisfaction surveys; d. measuring the effectiveness of marketing campaigns. 5. Business Transactions a. transfers of employee, customer or supplier files within a group of companies; b. carrying out mergers, acquisitions, or similar business transactions; c. conducting due diligence in business transactions; d. assignment of claims, or provision of claims as a security, within common financial transactions. The fact that a processing operation is covered by subparagraph 1 does not exempt the controller from ensuring that the processing operation is necessary for the purposes of the relevant legitimate interests pursued by the controller or by a third party, and that the interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. In doing so, the controller shall take into account, among others, the possible consequences of the intended processing for data subjects and the existence of appropriate safeguards."Justification
The package makes Article 6 more predictable by clarifying that anonymisation may require a lawful processing step, recognising safeguarded intra-group administrative transfers, and adding a non-exhaustive Annex of legitimate-interest use cases. This supports consistent application across the Union without creating a blanket permission: necessity, proportionality and the balancing test remain required, especially for children. Commission updates after EDPB consultation keep the framework adaptable to new technologies and business practices.
noyb's comment:
The amendment includes a derogation in relation to Article 6(1)(f) which is not foreseen in the current regime. In general, the purposes behind legitimate interests should always be context specific, rather than standardised.
#1596 Article 2 – paragraph 2 – point da (new) (Article 3 – paragraph 1 – subparagraph 1 (new))
Authored by
Regulation (EU) 2016/679
Article 2 – paragraph 2 – point da (new)
Text proposed by the Commission
Amendment
The following point (da) is added to Article 2(2): '(da) by a natural person in the course of an activity carried out entirely on a voluntary basis, unless that activity involves a type of processing listed pursuant to Article 35(4) GDPR.'
noyb's comment:
The change reduces data protection by narrowing the scope of the GDPR but facilitating complaince for voluntary activities. At the same time cooperation with controllers covered by the GDPR will likely be more complicated.
#1597 Article 88d (new) (Article 3 – paragraph 1 – point 15 b (new))
Authored by
Regulation (EU) 2016/679
Article 88d (new)
Text proposed by the Commission
Amendment
15b. A new Article 88d is added after Article 88c: 'Article 88d Processing of personal data in industrial operational environments 1. Where personal data are generated or collected by industrial machinery, industrial equipment, production systems or industrial internet-of-things devices in the course of their operation in an industrial operational environment, and are processed by a controller or processor solely for the purposes of operating, maintaining, monitoring, improving or securing such machinery, equipment, systems or devices, Articles 15 to 22, Article 30 and Article 35 shall not apply, provided that the conditions laid down in paragraph 2 are met. 2. Paragraph 1 shall apply only where the controller or processor, as applicable, implements appropriate technical and organisational measures to ensure that the personal data are pseudonymised, or that any identifiers that are not strictly needed for the purposes described in paragraph 1 are removed, and are not processed for the purpose of evaluating the performance, behaviour or conduct of an identified or identifiable natural person, and are not used to take a decision producing legal effects concerning a data subject or similarly significantly affecting him or her within the meaning of Article 22(1). 3. This Article shall not apply to the processing of special categories of personal data referred to in Article 9(1), nor to personal data relating to criminal convictions and offences referred to in Article 10.'Justification
Industrial machinery, production systems and IIoT devices generate operational data that may incidentally include identifiers such as user IDs, staff numbers or logs. Where processing is solely for operating, maintaining, improving or securing equipment, and not for monitoring workers or taking decisions about individuals, selected GDPR duties can be disproportionate. The amendment creates a narrow risk-based exemption, requiring pseudonymisation or identifier removal, excluding Article 9/10 data and preserving core GDPR principles, lawful basis and security duties.
noyb's comment:
This proposal targets data collected in an industrial environment and takes it out of the scope of most data subjects’ rights and some documentation obligations. While the provision also provides for safeguards, the level of data protection would still be reduced. The administrative burden due to the characterisation of this industrial data as personal data would be reduced.
#1598 Articles 88e, 88f, 88g (new) (Article 3 – paragraph 1 – point 15 c (new))
Authored by
Regulation (EU) 2016/679
Articles 88e, 88f, 88g (new)
Text proposed by the Commission
Amendment
15c. After Article 88c, the following Articles 88e, 88f, 88g are added: 'Article 88e Data protection regulatory sandboxes 1. Member States shall ensure that their competent supervisory authorities establish at least one data protection regulatory sandbox at national level, which shall be operational by 2 August 2028. That sandbox may also be established jointly with the supervisory authorities of other Member States. The Commission may provide technical support, advice and tools for the establishment and operation of data protection regulatory sandboxes. The obligation under the first subparagraph may also be fulfilled by participating in an existing sandbox in so far as that participation provides an equivalent level of national coverage for the participating Member States. This Chapter is without prejudice to the rules laid down by other Union legal acts related to regulatory sandboxs, in particular Chapter 6 of Regulation (EU) 2024/1689. 2. Additional data protection regulatory sandboxes at regional or local level, or established jointly with the supervisory authorities of other Member States may also be established. 3. The European Data Protection Supervisor may also establish an data protection regulatory sandbox for Union institutions, bodies, offices and agencies. For this purpose references to national supervisory authorities in this Chapter shall be construed as references to the European Data Protection Supervisor. 4. Member States shall ensure that the supervisory authorities referred to in paragraphs 1 and 2 allocate sufficient resources to comply with this Article effectively and in a timely manner. Where appropriate, national supervisory authorities shall cooperate with other relevant authorities, and may allow for the involvement of other actors within the data protection ecosystem. This Article shall not affect other regulatory sandboxes established under Union or national law. Member States shall ensure an appropriate level of cooperation between the authorities supervising those other sandboxes and the national supervisory authorities. 5. Data protection regulatory sandboxes established under this Article shall provide for a controlled environment that fosters innovation and facilitates the development, testing and validation of innovative data processing for a limited time before processing of personal data takes place pursuant to a specific sandbox plan agreed between the controller and the supervisory authority, ensuring that appropriate safeguards are in place. 6. Supervisory authorities shall provide, as appropriate, guidance, supervision and support within the data protection regulatory sandbox with a view to identifying risks, in particular to fundamental rights, health and safety, testing, mitigation measures, and their effectiveness in relation to the obligations and requirements of this Regulation and, where relevant, other Union and national law supervised within the sandbox. 7. Supervisory authorities shall provide controllers participating in the data protection regulatory sandbox with guidance on regulatory expectations and how to fulfil the requirements and obligations set out in this Regulation. Upon request of the controller, the supervisory authority shall provide a written proof of the activities successfully carried out in the sandbox. The supervisory authority shall also provide an exit report detailing the activities carried out in the sandbox and the related results and learning outcomes 8. If the controller and the national supervisory authority explicitly agree, the exit report may be made publicly available through the single information platform referred to in this Article. 9. The establishment of data protection regulatory sandboxes shall aim to contribute to the following objectives: a. improving legal certainty to achieve regulatory compliance with this Regulation or, where relevant, other applicable Union and national law; b. supporting the sharing of best practices through cooperation with the authorities involved in the data protection regulatory sandbox; c. fostering innovation and competitiveness and facilitating the development of a data protection ecosystem; d. contributing to evidence-based regulatory learning; e. facilitating and accelerating access to the Union market for technical developments, in particular when provided by SMEs, including start-ups, and SMCs. 10. Where the technical developments constitute AI systems, the competent national authorities shall additionally ensure that the national market surveillance authorities within the meaning of Article 3, point (26), of Regulation (EU) 2024/1689 are involved in the operation of the data protection regulatory sandbox to the extent of their respective tasks and powers. 11. The data protection regulatory sandboxes shall not affect the supervisory or corrective powers of the competent authorities supervising the sandboxes, including at regional or local level. Any significant risks to health and safety and fundamental rights identified during the development and testing of such technical developments shall result in an adequate mitigation. National competent authorities shall have the power to temporarily or permanently suspend the testing process, or the participation in the sandbox if no effective mitigation is possible, and shall inform the EDPB of such decision. National competent authorities shall exercise their supervisory powers within the limits of the relevant law, using their discretionary powers when implementing legal provisions in respect of a specific data protection regulatory sandbox project, with the objective of supporting innovation in data protection in the Union. 12. Controllers participating in the data protection regulatory sandbox shall remain liable under applicable Union and national liability law for any damage inflicted on third parties as a result of the experimentation taking place in the sandbox. However, provided that the controllers observe the specific plan and the terms and conditions for their participation and follow in good faith the guidance given by the national supervisory authority, no administrative fines shall be imposed by the authorities for infringements of this Regulation. Where other competent authorities responsible for other Union and national law were actively involved in the supervision of the data processing in the sandbox and provided guidance for compliance, no administrative fines shall be imposed regarding that law. 13. The data protection regulatory sandboxes shall be designed and implemented in such a way that, where relevant, they facilitate cross-border cooperation between national supervisory authorities. 14. National supervisory authorities, the EDPS and the Commission shall, as appropriate and within their respective competences, coordinate their activities and cooperate within the framework of the EDPB. They may support the joint establishment and operation of data protection regulatory sandboxes, including in different sectors and exchange best practices on related matters. 15. National supervisory authorities shall inform the EDPB of the establishment of a sandbox. The EDPB shall make publicly available a list of planned and existing sandboxes and keep it up to date in order to encourage more interaction in the data protection regulatory sandboxes and cross-border cooperation. 16. National supervisory authorities shall submit annual reports to the EDPB and the Commission, from one year after the establishment of the data protection regulatory sandbox and every year thereafter until its termination, and a final report. Those reports shall provide information on the progress and results of the implementation of those sandboxes, including best practices, incidents, lessons learnt and recommendations on their setup and, where relevant, on the application and possible revision of this Regulation, including its delegated and implementing acts, and on the application of other Union law supervised by the competent authorities within the sandbox. The national supervisory authorities shall make those annual reports or abstracts thereof available to the public, online. The Commission shall, where appropriate, take the annual reports into account when exercising its tasks under this Regulation. 17. The Commission shall develop a single and dedicated interface containing all relevant information related to data protection regulatory sandboxes to allow stakeholders to interact with data protection regulatory sandboxes and to raise enquiries with supervisory authorities, and to seek non-binding guidance on the conformity of innovative products, services, business models embedding data protection technologies. The Commission shall proactively coordinate with national supervisory authorities, where relevant. Article 88f Detailed arrangements for, and functioning of, data protection regulatory sandboxes 1. In order to avoid fragmentation across the Union, the EDPB shall establish and make public a framework specifying the detailed arrangements for the establishment, development, implementation, operation, governance, and supervision of the data protection regulatory sandboxes. The framework shall include common principles on the following issues: a. eligibility and selection criteria for participation in the data protection regulatory sandbox; b. procedures for the application, participation, monitoring, exiting from and termination of the data protection regulatory sandbox, including the sandbox plan and the exit report; c. the terms and conditions applicable to the participants; d. the detailed rules applicable to the governance of data protection regulatory sandboxes covered under Article 88x, including the coordination and cooperation at national and EU level. 2. The framework referred to in paragraph 1 shall ensure: a. that data protection regulatory sandboxes are open to any applying controller of a technical developments who fulfils eligibility and selection criteria, which shall be transparent and fair, and that national supervisory authorities inform applicants of their decision within three months of the application; b. that data protection regulatory sandboxes allow broad and equal access and keep up with demand for participation; controllers may also submit applications in partnerships with other controllers and other relevant third parties; c. that the detailed arrangements for, and conditions concerning data protection regulatory sandboxes support, to the best extent possible, flexibility for national supervisory authorities to establish and operate their data protection regulatory sandboxes; d. that access to the data protection regulatory sandboxes is free of charge for SMEs, including start-ups, without prejudice to exceptional costs that national supervisory authorities may recover in a fair and proportionate manner; e. that data protection regulatory sandboxes facilitate the involvement of other relevant actors within the data protection ecosystem, such as SMEs, including start-ups, enterprises, innovators, testing and experimentation facilities, research and experimentation labs and European Digital Innovation Hubs, centres of excellence, individual researchers, in order to allow and facilitate cooperation with the public and private sectors; f. that procedures, processes and administrative requirements for application, selection, participation and exiting the data protection regulatory sandbox are simple, easily intelligible, and clearly communicated in order to facilitate the participation of SMEs, including start-ups, with limited legal and administrative capacities and are streamlined across the Union, in order to avoid fragmentation and that participation in an data protection regulatory sandbox established by a Member State, or by the European Data Protection Supervisor is mutually and uniformly recognised and carries the same legal effects across the Union; g. that participation in the data protection regulatory sandbox is limited to a period that is appropriate to the complexity and scale of the project and that may be extended by the national supervisory authority; h. that data protection regulatory sandboxes facilitate the development of tools and infrastructure for testing, benchmarking, assessing and explaining dimensions of data processing relevant for regulatory learning, such as accuracy, data minimisation and security of processing as well as measures to mitigate risks to fundamental rights and society at large. Article 88g Further processing of personal data for developing certain technical developments data processing in the public interest in the data protection regulatory sandbox 1. In the data protection regulatory sandbox, personal data lawfully collected for other purposes may be processed solely for the purpose of developing and testing certain technical developments in the sandbox when all of the following conditions are met: a. Technical developments shall be developed for safeguarding substantial public interest by a public authority or another natural or legal person and in one or more of the following areas: i. public safety and public health, including disease detection, diagnosis prevention, control and treatment and improvement of health care systems; ii. a high level of protection and improvement of the quality of the environment, protection of biodiversity, protection against pollution, green transition measures, climate change mitigation and adaptation measures; iii. energy sustainability; iv. safety and resilience of transport systems and mobility, critical infrastructure and networks; v. efficiency and quality of public administration and public services; vi. the protection of the data subject or the rights and freedoms of others; b. the data processed are necessary for complying with one or more of the requirements referred to in Articles 25, 32 or 35 where those requirements cannot effectively be fulfilled by processing anonymised, synthetic or other non-personal data; c. there are effective monitoring mechanisms to identify if any high risks to the rights and freedoms of the data subjects, as referred to in Article 35, may arise during the sandbox experimentation, as well as response mechanisms to promptly mitigate those risks and, where necessary, stop the processing; d. any personal data to be processed in the context of the sandbox are in a functionally separate, isolated and protected data processing environment under the responsibility of the controller and only authorised persons have access to those data; e. controllers can further share the originally collected data only in accordance with Union data protection law; any personal data created in the sandbox cannot be shared outside the sandbox; f. any processing of personal data in the context of the sandbox does not leads to measures or decisions affecting the data subjects; g. any personal data processed in the context of the sandbox are protected by means of appropriate technical and organisational measures and deleted once the participation in the sandbox has terminated or the personal data has reached the end of its retention period; h. the logs of the processing of personal data in the context of the sandbox are kept for the duration of the participation in the sandbox, unless provided otherwise by Union or national law; i. a complete and detailed description of the process and rationale behind the testing and validation of the data processing is kept together with the testing results; j. a short summary of the data processing project developed in the sandbox, its objectives and expected results is published on the website of the supervisory authorities; this obligation shall not cover sensitive operational data in relation to the activities of law enforcement, border control, immigration or asylum authorities. 2. To the processing of personal data carried out within an data protection regulatory sandbox, provided that the processing takes place exclusively within the Union and it is ensured that authorities or other bodies of third countries cannot gain access to the processed data, only Article 5(1), point (f), in conjunction with paragraph 2, Article 24 and Article 32 shall apply, in addition to Chapters I, X and XI. For the processing of personal data carried out within a data protection regulatory sandbox, and provided that the processing takes place exclusively within the Union and that access to the processed data by authorities or other bodies of third countries is prevented, Member States shall provide for derogations from or exemptions to Chapter II (Principles), Chapter III (Rights of the data subject), Chapter IV (Controller and processor), Chapter V (Transfers of personal data to third countries or international organisations), Chapter VI (Independent supervisory authorities), Chapter VII (Cooperation and consistency) and Chapter IX (Provisions relating to specific processing situations) where this is necessary to reconcile the right to the protection of personal data with the objective of fostering innovation and strengthening the competitiveness of the Union. 3. Paragraph 1 is without prejudice to Union or national law which excludes processing of personal data for other purposes than those explicitly mentioned in that law, as well as to Union or national law laying down the basis for the processing of personal data which is necessary for the purpose of developing, testing of innovative processing operations or any other legal basis, in compliance with Union law on the protection of personal data.'Justification
Data protection sandboxes make GDPR compliance more predictable for innovative processing, PETs and AI use cases. Building on the AI Act model, they provide controlled testing, supervisory guidance, exit reports, cross-border learning and SME access. No-fine protection applies only where participants follow the agreed plan in good faith; authorities keep corrective powers, liability remains, high risks must be mitigated and public-interest further processing is subject to strict safeguards.
noyb's comment:
While the support and oversight by the supervisory authority envisioned by this proposal would help participants of the sandbox implement new processing activities, the very broad exemptions from the GDPR would almost certainly result in a reduction of the level of data protection. At the same time the very complex set of rules governing the sandboxes and allowing for a number of different interpretations and implementations by member states and authorities does not seem likely to result in any simplification.
#1599 Article 14 – paragraph 5a (new) (Article 3 – paragraph 1 a (new))
Authored by
Regulation (EU) 2016/679
Article 14 – paragraph 5a (new)
Present text
Article 14 Information to be provided where personal data have not been obtained from the data subject 1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information: (a) the identity and the contact details of the controller and, where applicable, of the controller's representative; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) the categories of personal data concerned; (e) the recipients or categories of recipients of the personal data, if any; (f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available. 2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; (c) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability; (d) where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (e) the right to lodge a complaint with a supervisory authority; (f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources; (g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. The controller shall provide the information referred to in para graphs 1 and 2: (a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circum stances in which the personal data are processed; (b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or (c) if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed. 4. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2. 5. Paragraphs 1 to 4 shall not apply where and insofar as: (a) the data subject already has the information; (b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available; (c) obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject's legitimate interests; or (d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.Amendment
In Article 14, paragraph 5a is added: "'5a. Where the controller is an association, foundation, or other non-profit organisation, and the personal data have not been obtained from the data subject, paragraphs 1 to 5 shall not apply where providing the information would require a disproportionate effort and the processing is limited to the internal purposes described in Article 13(6). In such cases, the controller shall adopt appropriate transparency measures.'"Justification
Non-profit organisations may receive personal data indirectly in the context of volunteer coordination, beneficiary support, charitable activities or membership-related administration. In such situations, providing individual information notices to each data subject can require disproportionate effort, particularly for small or volunteer-based organisations. This amendment allows proportionate transparency measures, such as public notices or online publication, where the processing remains limited to low-risk internal purposes. It preserves transparency while avoiding unnecessary bureaucracy for civil-society organisations.
noyb's comment:
The amendment includes a derogation which is not foreseen in the current regime.
#1600 Article 30 – paragraph 5a (new) (Article 3 – paragraph 1 b (new))
Authored by
Regulation (EU) 2016/679
Article 30 – paragraph 5a (new)
Present text
Article 30 Records of processing activities 1. Each controller and, where applicable, the controller's represen tative, shall maintain a record of processing activities under its respon sibility. That record shall contain all of the following information: (a) the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer; (b) the purposes of the processing; (c) a description of the categories of data subjects and of the categories of personal data; (d) the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or inter national organisations; (e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the docu mentation of suitable safeguards; (f) where possible, the envisaged time limits for erasure of the different categories of data; (g) where possible, a general description of the technical and organisa tional security measures referred to in Article 32(1). 2. Each processor and, where applicable, the processor's representa tive shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing: (a) the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller's or the processor's represen tative, and the data protection officer; (b) the categories of processing carried out on behalf of each controller; (c) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the docu mentation of suitable safeguards; B (d) where possible, a general description of the technical and organisa tional security measures referred to in Article 32(1). 3. The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form. 4. The controller or the processor and, where applicable, the controller's or the processor's representative, shall make the record available to the supervisory authority on request. 5. The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.Amendment
In Article 30, paragraph 5a is added "'5a. Paragraphs 1-4 shall not apply to associations, foundations, and other non-profit organisations whose processing activities are limited to the purposes described in Article 13(6).'"Justification
Record-keeping obligations under Article 30 should be proportionate to the actual risk of the processing activity. Small non-profit organisations, associations and foundations often lack dedicated compliance structures and process data only for limited internal administrative purposes. Requiring full records of processing activities in such low-risk cases creates administrative burdens without a corresponding benefit for data subjects. This amendment clarifies that the exemption applies to non-profit organisations where processing is limited to the purposes set out in Article 13(6), while preserving the full obligation where processing is likely to result in a high risk to the rights and freedoms of data subjects.
noyb's comment:
While this amendment aims to add a new paragraph, it – apparently incorrectly – shows a deletion of the existing Article 30(1) GDPR. Not taking this into account, the reduction of the scope of Article 30 for certain organisations would – for them – reduce their administrative workload.
#1601 Article 2 – paragraph 2 – point e (new) (Article 3 – paragraph 1 c (new))
Authored by
Regulation (EU) 2016/679
Article 2 – paragraph 2 – point e (new)
Present text
2. This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity;Amendment
In Article 2, the following point e is added: "'(e) by associations, foundations and other non-profit organisations established in the Union, where the processing is carried out solely in the course of their statutory non-commercial activities and is limited to the administration of members, former members, volunteers, donors or beneficiaries, provided that such processing does not involve systematic monitoring or processing likely to result in a high risk to the rights and freedoms of natural persons within the meaning of Article 35, and that the personal data are not disclosed to third parties for commercial purposes.'"Justification
Associations, foundations and other non-profit organisations generally process personal data within clear, direct and non-commercial relationships with their members, volunteers, donors or beneficiaries. Subjecting such limited and low-risk processing to the full scope of Regulation (EU) 2016/679 places a disproportionate administrative burden on civil-society and volunteer-based organisations, many of which lack dedicated compliance structures. This targeted exclusion complements the specific simplifications proposed for Articles 13, 14 and 30, while preserving the application of the Regulation to systematic monitoring, automated decision-making, high-risk processing and the commercial disclosure of personal data.
noyb's comment:
The amendment reduces protection by limiting the scope of the GDPR but with that simplifying compliance for the affected controllers. At the same time cooperation with controllers covered by the GDPR will likely be more complicated.
#1602 Article 9 – paragraph 2 – point k (new) (Article 3 – paragraph 1 d (new))
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k (new)
Present text
2. Paragraph 1 shall not apply if one of the following applies: (a)the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject; (b)processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject; (c)processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; (d)processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;(e)processing relates to personal data which are manifestly made public by the data subject;(f)processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity; (g)processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; (h)processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3; (i)processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;Amendment
In Article 9, paragraph 2 the following point k is added: "'(ja) processing is strictly necessary for the anonymisation of personal data pursuant to Article 6(3a), provided that the processing is subject to appropriate technical and organisational safeguards, that the data are not used to take measures or decisions concerning individual data subjects and that identifiable data are erased or rendered inaccessible as soon as they are no longer necessary for the anonymisation process.'"
#1603 Article 80 (Article 3 a (new))
Authored by
Regulation (EU) 2016/679
Article 80
Present text
Article 80 Representation of data subjects 1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.Amendment
Article 3 a (new) Article 80 is deleted. ""
noyb's comment:
The amendment removes the right for data subjects to mandate a representative.
#1604 Article 6 – paragraph 3a (new) (Article 3 b (new))
Authored by
Regulation (EU) 2016/679
Article 6 – paragraph 3a (new)
Present text
3. The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:(a)Union law; orAmendment
Article 3 b (new) In Article 6, the following paragraph 3a is inserted: "3a. Further processing of personal data for the sole purpose of anonymising those data shall be considered compatible with the purposes for which the personal data were initially collected and shall be lawful on the basis applicable to the initial processing."
noyb's comment:
This amendment allows controllers a derogation to anonymise data by claiming legitimate interest as a legal basis. This amendment can be beneficial for both controllers and data subjects.
#1605 Article 4 – point 5a (new) (Article 3 c (new))
Authored by
Regulation (EU) 2016/679
Article 4 – point 5a (new)
Present text
Article 4Definitions For the purposes of this Regulation: (1)‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; (2)‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; (3)‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future; (4)‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;Amendment
Article 3 c (new) In Article 4, the following point 5a is inserted "'(5a) “anonymisation” means the processing of personal data in such a manner that the resulting information does not or no longer constitute personal data for the controller or recipient concerned because the natural person to whom the information relates cannot be identified by means reasonably likely to be used by that controller or recipient, taking into account all objective factors and the means and criteria referred to in Article 41a;'"
noyb's comment:
(Full) anonymization can be good approahc. However, the Amendment now defines "relative" anonymization (conroller or a recipient). It also grants the power to determine the application of the GDPR to the Commission, which could violate Article 8(3) of the Charter.
#1716 Article 5 – paragraph 3 (Article 5 – paragraph 1 – point 2)
Authored by
Directive 2002/58/EC
Article 5 – paragraph 3
Text proposed by the Commission
2. After Article 5(3), the following subparagraph is added: ‘This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.’Amendment
deleted
#1721 Article 5 – paragraph 3 (Article 5 – paragraph 1 – point 2 – introductory part)
Authored by
Directive 2002/58/EC
Article 5 – paragraph 3
Text proposed by the Commission
2. After Article 5(3), the following subparagraph is added:Amendment
2. Article 5(3) is deleted.Justification
The AM removes overlapping ePrivacy rules on security, terminal access, metadata, location data and direct marketing where personal-data processing is already governed by the GDPR. Keeping parallel regimes creates consent fatigue, divergent national transpositions and legal uncertainty, including stricter rules for some anonymous device data than for personal data. Consolidation under the GDPR’s risk-based framework simplifies compliance, strengthens coherent rights exercise, supports innovation and preserves sector-specific rules in dedicated instruments.
noyb's comment:
Removes the ePrivacy protection. The GDPR currently does not provide for the same protection.
#1730 Article 5 – paragraph 3 – subparagraph 2 (new) (Article 5 – paragraph 1 – point 2)
Authored by
Directive 2002/58/EC
Article 5 – paragraph 3 – subparagraph 2 (new)
Text proposed by the Commission
This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.Amendment
The processing of personal data previously governed by these provisions shall be exclusively subject to Regulation (EU) 2016/679. (It applies to overall directive.)Justification
The AM removes overlapping ePrivacy rules on security, terminal access, metadata, location data and direct marketing where personal-data processing is already governed by the GDPR. Keeping parallel regimes creates consent fatigue, divergent national transpositions and legal uncertainty, including stricter rules for some anonymous device data than for personal data. Consolidation under the GDPR’s risk-based framework simplifies compliance, strengthens coherent rights exercise, supports innovation and preserves sector-specific rules in dedicated instruments.
noyb's comment:
Removes ePrivacy Protection and is limited to personal data, while the ePrivacy Protectin offered broader protection.
#1732 Article 6 (Article 5 – paragraph 1 – point 2 a (new))
Authored by
Directive 2002/58/EC
Article 6
Text proposed by the Commission
Amendment
2a. Article 6 is deleted.Justification
The AM removes overlapping ePrivacy rules on security, terminal access, metadata, location data and direct marketing where personal-data processing is already governed by the GDPR. Keeping parallel regimes creates consent fatigue, divergent national transpositions and legal uncertainty, including stricter rules for some anonymous device data than for personal data. Consolidation under the GDPR’s risk-based framework simplifies compliance, strengthens coherent rights exercise, supports innovation and preserves sector-specific rules in dedicated instruments.
#1733 Article 9 (Article 5 – paragraph 1 – point 2 b (new))
Authored by
Directive 2002/58/EC
Article 9
Text proposed by the Commission
Amendment
2b. Article 9 is deleted.Justification
The AM removes overlapping ePrivacy rules on security, terminal access, metadata, location data and direct marketing where personal-data processing is already governed by the GDPR. Keeping parallel regimes creates consent fatigue, divergent national transpositions and legal uncertainty, including stricter rules for some anonymous device data than for personal data. Consolidation under the GDPR’s risk-based framework simplifies compliance, strengthens coherent rights exercise, supports innovation and preserves sector-specific rules in dedicated instruments.
#1735 Article 13 (Article 5 – paragraph 1 – point 2 c (new))
Authored by
Directive 2002/58/EC
Article 13
Text proposed by the Commission
Amendment
2c. Article 13 is deleted.Justification
The AM removes overlapping ePrivacy rules on security, terminal access, metadata, location data and direct marketing where personal-data processing is already governed by the GDPR. Keeping parallel regimes creates consent fatigue, divergent national transpositions and legal uncertainty, including stricter rules for some anonymous device data than for personal data. Consolidation under the GDPR’s risk-based framework simplifies compliance, strengthens coherent rights exercise, supports innovation and preserves sector-specific rules in dedicated instruments.