Amendments by Patriots for Europe Group | GDPR-OMNIBUS | Data Privacy in the EU Omnibus amendments

Text proposed by the Commission

Amendment

(4a) Recent developments have demonstrated that advanced digital services, including data processing, cloud computing and artificial intelligence systems, may be subject to unilateral restrictions, export controls, licensing limitations or other measures adopted by third-country authorities. Such measures may lead to the interruption, degradation or withdrawal of services provided to users established in the Union, irrespective of their contractual rights. In view of the strategic importance of artificial intelligence and data-processing capabilities, excessive dependence on providers exposed to such measures may pose risks to the Union’s economic security, technological sovereignty, research capacity and industrial resilience, in particular where the services concerned process or rely on high-value datasets, including trade secrets, industrial know-how, research data, strategic business information or data originating from natural persons, whether in identifiable, pseudonymised or otherwise non-identifiable form. It is therefore appropriate to mitigate such dependencies through interoperability, portability and switching measures, business continuity arrangements, privacy-preserving technologies and appropriate technical and contractual safeguards against unilateral service disruption or termination, including ‘kill switch’ scenarios. Such measures should apply irrespective of the degree of integration of the services concerned or of the legal status of the entities concerned under Union law, including data intermediation services and recognised data altruism organisations.

Justification

The recent suspension of access to advanced AI models under export-control measures has made concrete the risk of unilateral interruption decided by a third-country authority. This recital establishes the need for resilience measures introduced in the operative part on an effect-based basis (dependency, switchability, jurisdictional exposure).

noyb's comment:

Can have an impact on future interpretation, but no direct impact on the law when it comes to B2B relations, empowering most controllers versus large processors. Highlighting the option for a 'kill switch' can also be relevant from a privacy perspective.

#188 Recital 24 b (new)

Authored by

Text proposed by the Commission

Amendment

(24b) In accordance with Regulation (EU) 2016/679, the principles of data protection should not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person, or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. Re-identification of data subjects from anonymised datasets should be prohibited. This should not prejudice the possibility to conduct research into anonymisation techniques, in particular for the purpose of ensuring information security, improving existing anonymisation techniques and contributing to the overall robustness of anonymisation, undertaken in accordance with Regulation (EU) 2016/679.

Justification

The prohibition of re-identification is the necessary corollary of any anonymisation regime. Its disappearance with the repeal of the DGA would leave the new definition of anonymised data without a sanction for its circumvention.

noyb's comment:

If a data subject is no longer identifiable, that should mean that re-identification is impossible. Thus true anonymisation should not necessitate safeguards such as highlighted in this proposal.

#223 Recital 27

Authored by

Text proposed by the Commission

(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵ . The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act. _________________ ¹⁵ Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (OJ L, 2025/327, 5.3.2025, ELI: http://data.europa.eu/eli/reg/2025/327/oj)

Amendment

(27) Regulation (EU) 2016/679 protects natural persons with regard to the processing of personal data. Personal data originate from a natural person and derive their protected character from that origin. Any clarification of the notion of identifiability must therefore preserve the link between the data and the natural person from whom they originate, and may not have the effect of removing from the scope of that Regulation data which relate to a natural person merely because a given entity is not, at a given moment, in a position to identify that person. This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. The definition of personal data as currently laid down in Regulation (EU) 2016/679 shall not be called into question. Personal data originates from a natural person; whether it remains personal data depends on whether that person is identifiable, the degree of re-identifiability being assessed through the notions of pseudonymous, pseudonymised and anonymised data. The assessment of whether a natural person is identifiable shall be distinguished from the definition of personal data, except for anonymised data, which lose their qualification as personal data. The new specifications introduced by this Regulation apply to the notions of 'pseudonymous' and 'pseudonymisation'. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵ . The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act. _________________ ¹⁵ Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (OJ L, 2025/327, 5.3.2025, ELI: http://data.europa.eu/eli/reg/2025/327/oj)

Justification

The Commission introduces the relativity of the notion of personal data into the definition itself, in Article 4. This exceeds a technical amendment and touches upon the substance of a fundamental right, as the EDPB and the EDPS have both stressed. The amendment leaves the definition intact and houses identifiability in a graded regime — pseudonymous, pseudonymised, anonymised — which delivers the same legal certainty without distorting Article 4.

noyb's comment:

The amendment improves the Commission's recital and seems to indicate a clear oppostite approach.

#226 Recital 27 a (new)

Authored by

Text proposed by the Commission

Amendment

(27a) The case-law of the Court of Justice (Case C-413/23 P, EDPS v SRB) confirms that the personal character of data is not an absolute feature and that pseudonymised data may, depending on the circumstances of the case, not be identifiable for a given recipient. However, that assessment is, by the Court's own method, a factual analysis to be carried out in each individual case, taking into account the means reasonably likely to be used and the technical, organisational and legal measures in place. Such a contextual and evolving assessment cannot be transposed into a general and abstract rule written into the definition of personal data in Article 4 without distorting that method and weakening the level of protection. The definition of personal data therefore remains unchanged. The relative and contextual character of identifiability is reflected in the graded regime of Article 4: what is decisive is whether the data is re-identifiable. Pseudonymous data is potentially re-identifiable; anonymised data is not re-identifiable; pseudonymised data is data that has undergone a state-of-the-art privacy-preserving service or technique. Pseudonymised data remain personal data for the controller holding the additional information and cannot as such be regarded as anonymised.

Justification

The Court proceeds by factual analysis on a case-by-case basis. Transposing that reasoning into a general and abstract rule inside the definition would distort the Court's own method. The relativity confirmed by the Court belongs to the notion of pseudonymisation, where the Court itself located it, not to Article 4(1).

noyb's comment:

The proposed text includes additional safeguards by separating the definition of Article 4(1) personal data, with Article 4(5) pseudonymisation.

#228 Recital 27 b (new)

Authored by

Text proposed by the Commission

Amendment

(27b) The recognised privacy-enhancing techniques on which the protection of pseudonymous data relies should reflect the state of the art and be promoted across the Union. They include, in particular, pseudonymisation and key separation, strong encryption of data at rest and in transit, aggregation and generalisation, the addition of statistical noise and differential privacy, synthetic data generation, secure multi-party computation, the use of secure processing environments, and contractual and organisational prohibitions on re-identification. The Commission, in close cooperation with the European Data Protection Board, should support controllers and processors in applying such techniques and in assessing the residual risk of re-identification, taking into account the means reasonably likely to be used, and should stipulate the relevant technical criteria by means of an implementing act.

Justification

Gives operational content to the notion of privacy-enhancing technique, on which the regime for pseudonymised data rests. The reference to an implementing act avoids freezing into the Regulation a state of the art that is bound to evolve.

noyb's comment:

Although PETs are welcome and required in the GDPR itself (e.g. Article 25 & Article 32), they are a logical minimum standard if data minimization is properly applied. The text of the recital states the obvious, but could also be understood as a basis for "privacy washing" via PETs.

#230 Recital 27 c (new)

Authored by

Text proposed by the Commission

Amendment

(27c) The principles of data minimisation and data protection by design and by default are essential when processing involves significant risks to the fundamental rights of individuals. Taking into account the state of the art, all parties to data sharing falling within the scope of this Regulation should implement appropriate technical and organisational measures to protect those rights. Such measures include not only pseudonymisation and encryption, but also increasingly available technologies that permit algorithms to be brought to the data and valuable insights to be derived without the transmission between parties or the unnecessary copying of the raw or structured data themselves, while minimising the exposure of personal data and of strategically significant data to unnecessary transfer, copying or third-country access. Where personal data would otherwise be transmitted or re-used, preference should be given, where technically available and proportionate, to methods that bring computation to the data within a secure processing environment, including federated analysis or equivalent privacy-preserving methods, over the transmission or copying of the data themselves.

noyb's comment:

Highlighting the practical application of the existing data minimization principle. No substantive change however.

#232 Recital 27 d (new)

Authored by

Text proposed by the Commission

Amendment

(27d) Data minimisation and data protection by design and by default are essential where processing involves significant risks to fundamental rights. Measures include not only pseudonymisation and encryption, but also technologies permitting algorithms to be brought to the data and insights to be derived without transmission between parties or unnecessary copying, while minimising the exposure of personal data and of strategically significant data to unnecessary transfer, copying or third-country access. Where personal data would otherwise be transmitted or re-used, preference should be given, where technically available and proportionate, to methods that bring computation to the data within a secure processing environment.

noyb's comment:

Highlighting the practical application of the existing data minimization principle. No substantive change however.

#236 Recital 28

Authored by

Text proposed by the Commission

(28) In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as methodological and systematic approach applied while conducting the research in the specific area. Research and technology development should be conducted in academic, industry and other settings, including small and medium-sized undertakings, (Article 179(2) TFEU) and should be always of a of high quality and should adhere to the principles of principles of reliability, honesty, respect and accountability (verifiability).

Amendment

(28) Scientific research should not include the profiling of natural persons, direct marketing, the monitoring of individuals' behaviour, or activities whose purpose is to influence or nudge the behaviour of natural persons, even where such activities apply scientific methods. The ethical standards of the relevant research area should be understood as those established within a recognised scientific discipline, and not as standards defined unilaterally by the controller for the purposes of a given processing operation. In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as methodological and systematic approach applied while conducting the research in the specific area. Research and technology development should be conducted in academic, industry and other settings, including small and medium-sized undertakings, (Article 179(2) TFEU) and should be always of a of high quality and should adhere to the principles of principles of reliability, honesty, respect and accountability (verifiability).

Justification

The broadening of research purposes must not allow processing whose principal object is behavioural targeting to be re-labelled as scientific research. Nor may the notion of 'research area' be defined by the controller itself: the ethical standards invoked must be those of a recognised discipline, failing which the safeguard is circular.

noyb's comment:

More criteria to exlude certain problematic processing activities for scientific reserach purposes are added.

#242 Recital 28 a (new)

Authored by

Text proposed by the Commission

Amendment

(28a) Research data, and in particular data concerning health, constitute a strategic asset for the Union and, at the same time, one of the most sensitive categories of personal data. Their processing for scientific research purposes should be subject to the safeguards laid down in Article 89(1), including data minimisation, pseudonymisation and, wherever the purpose of the research can be achieved without processing personal data, anonymisation. Their transfer to third countries, or their processing by providers exposed to extraterritorial measures, may create risks both for the data subjects concerned and for the research capacity of the Union, and should accordingly be accompanied by appropriate technical, organisational and contractual safeguards.

Justification

Health and research data raise a twofold issue: protection of individuals and strategic autonomy. The recital connects the two, consistently with the resilience approach in recital 4a.

noyb's comment:

Mere repitition of current GDPR requirements.

#250 Recital 29 a (new)

Authored by

Text proposed by the Commission

Amendment

(29a) Reliance on legitimate interest within the meaning of Article 6(1)(f) requires three cumulative conditions to be met: the pursuit by the controller or by a third party of an interest which is lawful, clearly and precisely articulated, and real and present rather than speculative; the necessity of the processing for that interest, which cannot reasonably be achieved by other means less intrusive for the data subject, including through the use of anonymised data; and the absence of an overriding of that interest by the interests or fundamental rights and freedoms of the data subject, having regard to the nature of the data, the context of the processing, its consequences, and the reasonable expectations of the data subject based on their relationship with the controller. Where those interests or rights would override the interest pursued, the controller may implement mitigating measures; where such measures are insufficient, the processing may not be based on that provision.

Justification

Codifies the three-condition test consistently applied by the Court and by the Board.

noyb's comment:

The proposed text codifies the three-condition test applied by the CJEU and by the European Data Protection Board (Guidelines 01/2024). No matrial change.

#257 Recital 30

Authored by

Text proposed by the Commission

Amendment

(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and personal data may, in some instances, be extracted from, regurgitated by, or inferred from the AI system or the AI model. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest pursued by the controller or by a third party, including the provider of a pre-trained model, within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. Such processing shall not benefit from any presumption of lawfulness and remains subject to a balancing test carried out on a case-by-case basis. The fact that a system or model is presented as producing anonymised data shall not, in itself, exclude the application of that Regulation where personal data may be extracted from, or inferred from, that system or model by means reasonably likely to be used. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.

Justification

Two corrections. First, the notions of 'retained', 'memorised' or 'stored' data mischaracterise how AI models function: what matters legally is whether personal data can be extracted from, regurgitated by, or inferred from the model. Second, the reference to third-party legitimate interest, which has existed since 1995, secures the position of downstream SMEs deploying pre-trained models, while the explicit refusal of any presumption of lawfulness preserves the in concreto balancing required by the Court (C-252/21).

noyb's comment:

The amendment overcomplicates the existing 6(1)(f) balancing exercise and despite the justification, mentions providers of models instead of deployers.

#279 Recital 31

Authored by

Text proposed by the Commission

(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, providing an unconditional right to object to the processing of their personal data, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.

Amendment

(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, ensuring that data subjects are informed of their right to object to the processing of their personal data in accordance with Article 21 of Regulation (EU) 2016/679, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.

Justification

Recital (31) as proposed by the Commission refers to "an unconditional right to object" as one of the appropriate safeguards. This reference is inconsistent with the right to object as comprehensively regulated by Article 21 of Regulation (EU) 2016/679, which provides for conditions and limitations to that right. This amendment brings it into alignment with the proposed amendment to Article 88c.

noyb's comment:

The proposed amendment suggesting to remove the unconditional character of the right to object to AI processing operations diminishes the data subjects' control over their personal data.

#303 Recital 33

Authored by

Text proposed by the Commission

Amendment

(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be extracted or inferred from, in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, notably where the removal of special categories of data inextractable from in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. Where special categories of personal data are collected incidentally and residually in the course of web scraping from publicly accessible sources, the prohibition laid down in Article 9(1) applies to the controller within the framework of its responsibilities, powers and capabilities, in accordance with the case-law of the Court of Justice (Case C-136/17, GC and Others), provided that the controller implements measures to prevent the collection and the dissemination of such data, such as applying filters, excluding sources structurally containing such data, deleting such data immediately upon identification, preventing their extraction from the model, and monitoring the outputs of the system. The mere accessibility of personal data online does not constitute consent, nor does the absence of a technical measure opposing scraping. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.

Justification

Aligns the terminology with the technical reality of AI models and codifies the 'responsibilities, powers and capabilities' test established by the Court in GC and Others, as applied by the EDPB in its Guidelines 03/2026 on web scraping. This provides legal certainty for the incidental collection of special categories without widening the derogations of Article 9(2).

noyb's comment:

The proposed amendment is an improvement from a privacy perspective comared to the Commission's proposal, but still allows processing under Article 9 GDPR that was so far not possible.

#307 Recital 33

Authored by

Text proposed by the Commission

Amendment

Justification

This amendment ensures interpretive consistency between the recital and the operative provision and prevents supervisory authorities or courts from using the unchanged recital as a basis for a more restrictive interpretation of the derogation than that intended by the amended Article 9(5). It also reflects the extended scope of the controller's duty to act, which now covers situations in which the controller is notified of the presence of special categories of personal data by third parties, and not only cases of self-identification.

noyb's comment:

This amendment proposes that the controller only implements measures that are "economically feasible".

#309 Recital 33 a (new)

Authored by

Text proposed by the Commission

Amendment

(33a) The processing of personal data within an AI regulatory sandbox established pursuant to Regulation (EU) 2024/1689, or in the course of testing in real-world conditions, remains subject in full to Regulation (EU) 2016/679. Participation in a sandbox does not constitute a legal basis for processing, nor does it exempt the controller from the balancing test, from the obligation to carry out a data protection impact assessment, or from the rights of data subjects. The requirements of human oversight laid down in Article 14 of Regulation (EU) 2024/1689, and the classification of a system as high-risk under that Regulation, apply in addition to, and not in substitution for, the safeguards of Regulation (EU) 2016/679.

Justification

Clarifies the interplay between AI sandboxes and real-world testing and GDPR Regulation.

noyb's comment:

The proposed amendment explains the interplay between regulatory sandboxes and the application of the GDPR.

#330 Recital 35

Authored by

Text proposed by the Commission

(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. By contrast, it should be clarified in Article 12 of the Regulation that the right of access, which is from the outset favourable to data subjects, should not be abused in the sense that the data subjects abuse them for purposes other than the protection of their data. For example, such an abuse of the right of access would arise where the data subject intends to cause the controller to refuse an access request, in order to subsequently demand the payment of compensation, potentially under the threat of bringing a claim for damages. Other examples of abuse include situations where data subjects make excessive use of the right of access with the only intent of causing damage or harm to the controller or when an individual makes a request, but at the same time offers to withdraw it in return for some form of benefit from the controller. Moreover, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive conduct of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abuse only to a reasonable level. In any event, while requesting access under Article 15 of Regulation (EU) 2016/679 the data subject should be as specific as possible. Overly broad and undifferentiated requests should also be regarded as excessive.

Amendment

(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. By contrast, it should be clarified in Article 12 of the Regulation that the right of access, which is from the outset favourable to data subjects, should not be abused in the sense that the data subjects abuse the means at their disposal to enforce the rights conferred by this Regulation for purposes unrelated to the protection of their data. A request may in particular be regarded as excessive where those means are used for the purpose of obtaining commercially sensitive information or gaining insight into the internal processes of the controller, including for the benefit of an undertaking competing with the controller, of exerting pressure in unrelated proceedings, or of disrupting the administrative operations of the controller by imposing a manifestly disproportionate burden. Conversely, the exercise of the rights conferred by this Regulation for the purpose of verifying, in good faith, whether a controller complies with this Regulation shall not be regarded as unfounded or excessive, irrespective of whether those rights are exercised individually or with the assistance of, or through, a body referred to in Article 80. For example, such an abuse of the right of access would arise where the data subject intends to cause the controller to refuse an access request, in order to subsequently demand the payment of compensation, potentially under the threat of bringing a claim for damages. Other examples of abuse include situations where data subjects make excessive use of the right of access with the only intent of causing damage or harm to the controller or when an individual makes a request, but at the same time offers to withdraw it in return for some form of benefit from the controller. Moreover, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive conduct of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abuse only to a reasonable level. In any event, while requesting access under Article 15 of Regulation (EU) 2016/679 the data subject should be as specific as possible. Overly broad and undifferentiated requests should also be regarded as excessive.

Justification

The notion of 'abuse of rights' is an autonomous concept of Union law which the Court applies with extreme caution; invoking it against a fundamental right would be disproportionate and legally exposed. What is targeted is the instrumental use of the procedural means, not the right itself. The good-faith compliance-verification safeguard, anchored in Article 80, expressly protects citizen and non-profit scrutiny.

noyb's comment:

The amendment goes further than the restrictions proposed by the Commission.

#343 Recital 36

Authored by

Text proposed by the Commission

(36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller. These should be the situations where the context of the relationship between the controller and the data subject is very clear and circumscribed and the controller’s activity is not data-intensive, such as the relationship between a craftsman and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment. In such circumstances, that is to say when the processing is non data-intensive, non-complex and where the controller collects a low amount of personal data, it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679. The same should apply to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.

Amendment

(36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller. These should be the situations where the context of the relationship between the controller and the data subject is very clear and circumscribed and the controller’s activity is not data-intensive, such as the relationship between a craftsman and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment. The same applies to associations, sport clubs, and micro, small and medium-sized enterprises where the processing of personal data is confined to the management of membership, communication with members, the organisation of activities, or the performance of a contract with the data subject. The derogation does not apply where the controller engages in the collection of personal data from third parties, in their purchase, aggregation, enrichment, sale or making available to third parties for commercial purposes, such activities being by nature data-intensive. In such circumstances, that is to say when the processing is non data-intensive, non-complex and where the controller collects a low amount of personal data, it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679. The same should apply to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.

noyb's comment:

This proposal further elaborates on the Commission's proposal regarding an additional exemption from the information obligation in Article 13 GDPR. However, the provision is in particular unworkable for the SMEs which are supposed to be the beneficiaries of the provision.

#348 Recital 36 a (new)

Authored by

Text proposed by the Commission

Amendment

(36a) Article 22(1) confers on the data subject the right not to be subject to such a decision. That right is a prohibition of principle, subject to the limited exceptions laid down in Article 22(2), and not an authorisation subject to conditions. The safeguards laid down in Article 22(3), and in particular the right to obtain human intervention, to express one's point of view and to contest the decision, apply in full. The requirements of human oversight laid down in Article 14 of Regulation (EU) 2024/1689 apply in addition to, and not in substitution for, those safeguards.

noyb's comment:

This highlights the positive clarifications by the CJEU (SCHUFA II) regarding this Article. It also pushes back to the commission’s draft, framing Article 22 as an authorisation subject to conditions.

#349 Recital 36 b (new)

Authored by

Text proposed by the Commission

Amendment

(36b) Micro, small and medium-sized enterprises and small mid-caps which are not related undertakings should be able to designate a single data protection officer jointly, provided that the officer is easily accessible from each establishment and that the conditions of independence and absence of conflict of interest laid down in Articles 38 and 39 are met in respect of each controller concerned. Such pooling reduces compliance costs without lowering the level of protection, and should not result in the officer being placed in a position of dependence in relation to any of the controllers concerned.

Justification

The cost of a dedicated DPO is prohibitive for small structures. Pooling across unrelated undertakings is possible provided that accessibility and independence are guaranteed for each controller.

noyb's comment:

This proposal deals with the option to allow SMEs to jointly designate a single data protection officer. In general, this is very similar to the appointment of external DPOs which is already possible.

#371 Recital 38

Authored by

Text proposed by the Commission

(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.

Amendment

(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. Article 22(1) confers on the data subject the right not to be subject to such a decision. That right is a prohibition of principle, subject to the limited exceptions laid down in Article 22(2), and not an authorisation subject to conditions. Where the controller relies on the necessity of the decision for entering into, or the performance of, a contract, that necessity shall be interpreted strictly. A decision is not necessary within the meaning of that provision where the purpose pursued can reasonably be achieved by means involving human intervention. The availability of an equally effective non-automated alternative excludes reliance on that exception. When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The safeguards laid down in Article 22(3), and in particular the right to obtain human intervention, to express one's point of view and to contest the decision, apply in full.

noyb's comment:

Positive codification of case law and legal doctrine.

#380 Recital 39

Authored by

Text proposed by the Commission

(39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches.

Amendment

Justification

Aligning the notification threshold with that of communication to the data subject is acceptable only if the documentation obligation is expressly preserved. Otherwise, non-notified breaches would become invisible to the authority even in the course of an inspection.

noyb's comment:

This proposal provides no material change to the Commission’s proposal. Due to the negative effect the Commission’s proposal would have on the level of privacy, the same has to apply to this amendment.

#387 Recital 39 a (new)

Authored by

Text proposed by the Commission

Amendment

(39a) The collection of personal data from third parties, and their purchase, aggregation, enrichment, sale or making available to third parties for commercial purposes, have given rise to opaque chains in which the origin of the data, the legal basis for their initial collection and the validity of any consent obtained can no longer be established. Successive transfers dilute accountability to the point where no operator in the chain is in a position to demonstrate the lawfulness of the processing. The principle of accountability laid down in Article 5(2) of Regulation (EU) 2016/679 requires that a controller engaging in such activities verify and document the lawful origin of the data, and refrain from processing them where that lawfulness cannot be demonstrated. A general declaration of compliance or a standard contractual term supplied by the data provider cannot suffice. That verification, which forms part of the measures referred to in Article 24 of that Regulation, should be strengthened where the data originate from an undisclosed or indeterminate source, where they concern a large number of data subjects, or where they have been obtained through successive transfers. This is without prejudice to the processing of personal data which is strictly necessary for the prevention and detection of fraud, where the data are processed exclusively for that purpose.

Justification

Data brokerage is the blind spot of the Regulation: personal data circulate through chains in which no operator can any longer demonstrate lawful origin. This recital does not create a new obligation — it specifies what the existing accountability principle requires of those who trade in data, and underpins the record-keeping and penalty provisions introduced in the operative part.

noyb's comment:

This proposal highlights some essential obligations of controllers that deal with personal data. Since these obligations are often ignored or misinterpreted a clarification has a positive privacy effect. Regarding simplicity, the positive clarifying effect and the increased simplicity for data subjects on the one hand, and the required administrative work for certain controllers more or less cancel each other out.

#393 Recital 40 a (new)

Authored by

Text proposed by the Commission

Amendment

(40a) Where, in respect of the same processing operation, a controller is required to carry out a data protection impact assessment under Article 35 of Regulation (EU) 2016/679 and is also subject to an obligation to carry out a fundamental rights impact assessment under Article 27 of Regulation (EU) 2024/1689, or to a reporting obligation in respect of automated monitoring or decision-making systems under other Union law, those obligations may be satisfied by means of a single integrated assessment. Such an assessment satisfies each of those obligations only where it covers all the elements required by each applicable provision; the substantive requirements, thresholds and triggering conditions laid down in those provisions remain unaffected. The integrated assessment should be made available to each competent authority within the framework of its respective competences and should not be required to be submitted to a single authority. The single Union list of processing operations subject to a data protection impact assessment should reflect processing operations presenting genuinely high risks to the rights and freedoms of natural persons, and should not consist of the accumulation of the requirements laid down in national lists.

Justification

Vertically integrated operators face a triple documentation burden for one and the same activity. The amendment mutualises the documentary instrument.

noyb's comment:

Combining the DPIA with other assessments like the FRIA could reduce administrative burden of controllers. Highlighting that the black-list should not consist of an accumulation of national lists could be interpreted as pushing to reduce the scope of required DPIAs.

#400 Recital 42 a (new)

Authored by

Text proposed by the Commission

Amendment

(42a) The European Data Innovation Board should support the consistent application of this Regulation, in particular as regards the promotion of state-of-the-art privacy-preserving and privacy-enhancing techniques, the interoperability of consent-management and agency-enhancing services, the governance of regulatory sandboxes for artificial intelligence in so far as they involve the processing of personal data, and the structured dialogue with strategic data ecosystems, data intermediation services and recognised data altruism organisations. It should cooperate closely with the European Data Protection Board, which retains sole competence as regards the protection of personal data.

Justification

Gives the EDIB a clear role as a forum for technical convergence, without encroaching on the competences of the EDPB or on those of national authorities.

noyb's comment:

Any guidance by the EDIB (established in the Data Act) has the potential to increase legal certainty while guidance from another organisation requires controllers and other actors to observe more actors and could lead to divergent opinions. Regarding simplification, this could more or less balance each other out .

#423 Recital 44 – paragraph 1

Authored by

Text proposed by the Commission

Amendment

The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment and the subsequent processing of such data should be regulated under a single legal framework, namely Regulation (EU) 2016/679, where the subscriber of the electronic communications service or the user of the terminal equipment is a natural person. The amendments presented in this Regulation continue to offer the highest levels of protection for personal data, while simplifying the experiences of data subjects in exerting their rights and expressing their choices online. The amendments concern in particular storage of information in that equipment, accessing or otherwise collecting information from that equipment that entails the processing of personal data through trackers, identifiers or similar technologies located on, or interacting with, terminal equipment, including but not limited to cookies to gain information from the terminal equipment. The relevant rules should also apply regardless of whether the terminal equipment is owned by the natural person or by another legal or natural person. These rules are without prejudice to Directive 2002/58/EC, which continues to apply in full, and in particular to the confidentiality of communications and of the related traffic data, the protection of traffic and location data, the safeguards against unsolicited communications, and the possibility for Member States to adopt restrictive measures, as provided for in Articles 5, 6, 9, 13 and 15(1) of that Directive.

noyb's comment:

Moves the obligations to the GDPR, but is unclear as the ePrivacy Directive still applies. Therefore, it is not simpler.

#457 Recital 44 a (new)

Authored by

Text proposed by the Commission

Amendment

(44a) Information relating to other natural persons stored in the terminal equipment of a user or subscriber, such as contact details, constitutes personal data of those persons. Consent given by the user or subscriber to the storing of, or access to, such information does not constitute consent by the natural persons to whom that information relates, nor a legal basis for any further processing of their personal data. Such information should not be transmitted to third parties, nor used for purposes other than those strictly necessary for the service explicitly requested by the user or subscriber. This confirms the confidentiality of communications protected by Directive 2002/58/EC, which extends to the identity of the persons with whom a user communicates.

Justification

Address books are the personal data of persons who have never consented to anything. Their systematic upload for the purpose of building social graphs or enriching profiles has no legal basis.

noyb's comment:

Confidentiality for address book data.

#460 Recital 45

Authored by

Text proposed by the Commission

Amendment

(45) Data subjects that have refused a request for consent are often confronted with a new request to give consent each time they visit the same controller’s online service again. This may have detrimental effects to the data subjects which may consent just in order to avoid repeating requests. The controller should therefore be obliged to respect the data subject’s choices to refuse a request for consent for at least a certain period. The single-click modality and the period referred to constitute an ergonomic ideal rather than a mandatory technological standard, their practical implementation being more complex and capable of varying according to context. Data subjects should be able to express and modulate their consent at several levels — terminal equipment, operating system, web browser, application or on a site-by-site basis — and to outsource its management to a consent and agency-enhancing service provider, a data intermediation service provided to data subjects or a personal data space. An automated indication should not preclude the expression of service-specific choices.

Justification

Privacy choices are contextual. A blanket signal imposed without granularity would conflict with the specificity requirement of consent under the Regulation itself. The amendment preserves the anti-fatigue objective while restoring the data subject's ability to modulate.

noyb's comment:

Goes back on the Commission proposal. Does not provide for simplification.

#466 Recital 46

Authored by

Text proposed by the Commission

Amendment

(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser or in the EU Digital Identity Wallet as set out by Regulation (EU) 914/2014, or any other adequate means. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. Such means should be interoperable, so that a signal expressed at one level, whether terminal, operating system, browser, application or website, is recognised and given effect at the others, including between different applications and between different terminal devices used by the same data subject, and should not constitute a single mandatory mechanism nor be provided in a manner that concentrates the management of consent within a single system or entity. The technical means should not be designed or operated so as to confer on the provider of a browser, operating system or terminal a preferential position in obtaining, refusing or managing consent. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, media service providers should not be obliged to respect the machine-readable indications of data subject’s choices. The obligation for providers of web browsers to provide the technical means for data subjects to make choices with respect to the processing should not undermine the possibility for media service providers to request consent by data subjects.

Justification

A mandate imposed on browsers risks creating a compulsory intermediary between publishers and their audience, reinforcing the very gatekeepers who control browsers and operating systems. The amendment preserves the interoperability of signals — including across applications and devices — while ruling out centralisation and the capture of consent management by access controllers.

noyb's comment:

Unclear if the mechanism should be mandatory. Can be read both ways.

#473 Recital 46 a (new)

Authored by

Text proposed by the Commission

Amendment

(46a) The amendments are without prejudice to Article 25 of Regulation (EU) 2016/679: controllers should implement data protection by design and by default, embedding state-of-the-art privacy-preserving and privacy-enhancing techniques from the outset. The amendments are equally without prejudice to the security of processing (Article 32), the notification of a personal data breach to the supervisory authority (Article 33) and the communication of a personal data breach to the data subject (Article 34).

Justification

A safeguard clause preventing the simplifications from being read as an implicit weakening of the security and notification obligations, which the proposal does not amend.

noyb's comment:

No direct impact.

#474 Recital 46 b (new)

Authored by

Text proposed by the Commission

Amendment

(46b) The processing of personal data should not give rise to profiling or to manipulative techniques contrary to Union law, in particular as regards behavioural targeting and the protection of children; the prohibitions and safeguards of Regulation (EU) 2016/679 and Regulation (EU) 2024/1689 continue to apply. Scientific research does not include processing whose principal object is to observe, profile or influence the behaviour of natural persons for commercial purposes, in particular behavioural advertising or the commercial targeting of individuals, even where scientific methods are used; this is without prejudice to fundamental or applied research, including where it delivers benefits in the general interest.

Justification

The broadening of research purposes must not allow processing whose principal object is behavioural targeting to be re-labelled as scientific research. The criterion retained is the principal object of the processing, not the method employed.

noyb's comment:

This amendment generally highlights privacy friendly aspects. The clarification in this recital is offset by some uncertainties regarding its scope and effect.

#476 Recital 46 c (new)

Authored by

Text proposed by the Commission

Amendment

(46c) The interface used to request, give, refuse or withdraw consent should be designed in a fair and neutral manner. It should not be designed, structured or operated in a way that deceives or manipulates the data subject, or that otherwise impairs their ability to make a free and informed decision. In particular, it should not give visual or other prominence to acceptance over refusal, whether through the size, colour, positioning or wording of the options; present the option to accept and the option to refuse in a manner that is not equally easy and equally accessible; use wording or design liable to create confusion or to induce consent; or repeat requests for consent in a manner liable to pressure the data subject into consenting. The option to refuse consent should be as easy to exercise, and presented with equivalent prominence, as the option to give consent. Consent should be freely given, specific, informed and unambiguous, and capable of being withdrawn as easily as it was given.

Justification

Codifies the elements of valid consent set out by the Board in its Guidelines 05/2020 and the prohibition of deceptive design in its Guidelines 03/2022. Consent that is obtained through a manipulated interface is not consent.

noyb's comment:

Clarifies the notion of consent beyond the Commission proposal.

#477 Recital 46 d (new)

Authored by

Text proposed by the Commission

Amendment

(46d) The creation of a permanent user account, or the provision of personal data by the data subject, may be required in order to access offers or to purchase goods or services only where strictly necessary. Where such access or purchase can be ensured without it, the controller should offer the data subject a clear, easily accessible and non-discriminatory means to proceed, which should not give rise to less favourable conditions for the data subject. Making access to a service conditional on the creation of an account which is not necessary for the performance of the contract deprives consent of its free character.

Justification

Forced account creation is a widespread practice which conditions access to a service on the provision of data that is unnecessary for the contract. The guest option restores the free character of consent required by Article 7(4).

noyb's comment:

Can be positive for privacy, regarding data minimisation.

#486 Recital 48

Authored by

Text proposed by the Commission

(48) Article 4 of Directive 2002/58/EC should be repealed. Article 4 of Directive 2002/58/EC sets requirements for providers of publicly available electronic communications services as regards safeguarding the security of their services and notification requirements. Subsequently, Directive (EU) 2022/2555 has set new requirements as regards cybersecurity risk-management measures and incident reporting for those providers. In order to reduce overlapping obligations for entities in the electronic communications sector, Article 4 of Directive 2002/58/EC should be repealed. As regards the security of processing of personal data pursuant to Article 4(1) and (1a) of this directive and the notification of personal data breaches pursuant to Article 4(3) to (5) of Directive 2002/58/EC this directive, the Regulation (EU) 2016/679 already provide for comprehensive and up-to-date rules. These rules should therefore apply to providers of publicly available electronic communication services and providers of public communications networks, thereby ensuring that one regime applies to the controllers and processors.

Amendment

deleted

noyb's comment:

Back to the current situation.

#488 Recital 48

Authored by

Text proposed by the Commission

(48) Article 4 of Directive 2002/58/EC should be repealed. Article 4 of Directive 2002/58/EC sets requirements for providers of publicly available electronic communications services as regards safeguarding the security of their services and notification requirements. Subsequently, Directive (EU) 2022/2555 has set new requirements as regards cybersecurity risk-management measures and incident reporting for those providers. In order to reduce overlapping obligations for entities in the electronic communications sector, Article 4 of Directive 2002/58/EC should be repealed. As regards the security of processing of personal data pursuant to Article 4(1) and (1a) of this directive and the notification of personal data breaches pursuant to Article 4(3) to (5) of Directive 2002/58/EC this directive, the Regulation (EU) 2016/679 already provide for comprehensive and up-to-date rules. These rules should therefore apply to providers of publicly available electronic communication services and providers of public communications networks, thereby ensuring that one regime applies to the controllers and processors.

Amendment

(48) Article 4 of Directive 2002/58/EC should be maintained. That Article sets specific requirements for providers of publicly available electronic communications services as regards safeguarding the security of their services and the notification of security breaches. That Article sets specific requirements for providers of publicly available electronic communications services as regards safeguarding the security of their services and the notification of security breaches. Those requirements are specific to the electronic communications sector and are not fully substituted by the general regimes of Directive (EU) 2022/2555 and Regulation (EU) 2016/679. Its repeal would leave sector-specific obligations without an equivalent, to the detriment of the confidentiality and integrity of communications. Those requirements are specific to the electronic communications sector and are not fully substituted by the general regimes of Directive (EU) 2022/2555 and Regulation (EU) 2016/679. Its repeal would leave sector-specific obligations without an equivalent, to the detriment of the confidentiality and integrity of communications.

Justification

The repeal of Article 4 of the ePrivacy Directive would empty of substance the sector-specific security regime applicable to electronic communications, on the assumption that NIS2 and the GDPR fully substitute for it. That assumption is not established. The Union should not dismantle a functioning protection in the name of an alignment whose equivalence is not demonstrated.

noyb's comment:

Specific duties for communication duties should be maintained. Back to the current situation.

#933 Article 4 – point 5 (Article 3 – paragraph 1 – point 1 – point a – introductory part)

Authored by

Regulation (EU) 2016/679
Article 4 – point 5

Text proposed by the Commission

(a) in point 1, the following sentences are added:

Amendment

(a) in point 5, the following sentences are added: Pseudonymisation does not form part of the definition of personal data laid down in point (1). Personal data which have undergone pseudonymisation and which could be attributed to a natural person by the use of additional information remain personal data for the controller holding that additional information, and cannot as such be regarded as anonymised. However, where personal data which have undergone pseudonymisation are made available to another entity, they may cease to be personal data in relation to that entity where the technical and organisational measures referred to in the first subparagraph effectively prevent that entity from attributing the data to the data subject, provided that: (a) that entity is not in a position to circumvent those measures in the course of any processing carried out under its control; and (b) those measures also prevent that entity from attributing the data to the data subject by other means reasonably likely to be used, including by combination with other information available to it. Where it cannot be excluded that the data will be further transmitted to third parties reasonably likely to be able to attribute them to the data subject, the data shall be regarded as personal data in respect of that transmission and of any subsequent processing by those third parties.

Justification

Codifies the judgment of the Court of Justice in Case C-413/23 P (EDPS v SRB) at the place where the Court itself situated it. Pseudonymisation does not form part of the definition of personal data (paragraph 72). Pseudonymised data remain personal data for the controller holding the additional information (paragraph 76) and cannot as such be regarded as anonymised (paragraph 73). They may, however, not be regarded as personal data in relation to a recipient where the technical and organisational measures have been effectively implemented and prevent that recipient from attributing the data to the data subject, including by combination with other information, so that the risk of identification is insignificant (paragraphs 75, 77 and 82). Where onward transmission to third parties able to re-identify cannot be excluded, the data remain personal data (paragraph 85).

noyb's comment:

The proposed text includes safeguards by separating the definition of Article 4(1) personal data, with Article 4(5) pseudonymisation, in line with EDPS v SRB. However, the relevant pseudonymised data should remain personal for any entity that can now or in the future hold additional information enabling them to re-identify data subjects.

#935 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)

Authored by

Regulation (EU) 2016/679
Article 4 – point 1 – second part

Text proposed by the Commission

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

Amendment

deleted

Justification

The Commission introduces into the very definition of personal data the principle that information is not personal for an entity which cannot identify the natural person concerned. This exceeds a technical amendment: it modifies the definition of a fundamental right, restricts the scope of the Regulation and creates legal uncertainty, as both the EDPB and the EDPS have stressed. The relativity of identifiability confirmed by the Court of Justice belongs to the notion of pseudonymisation (Case C-413/23 P, paragraphs 71 to 72), not to Article 4(1). The definition of personal data therefore remains unchanged, and the graded regime introduced in the following amendments provides the legal certainty sought without distorting the Court's method.

noyb's comment:

With such deletion, the regime stays the same as currently.

#962 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 38

Text proposed by the Commission

Amendment

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. Scientific research shall not include the profiling of natural persons, direct marketing, the monitoring of individuals' behaviour, or activities whose purpose is to influence or nudge the behaviour of natural persons, even where such activities apply scientific methods.

noyb's comment:

Narrows scope of definition, but overall still very broad compared to current understanding.

#979 Article 4 – point 38a (new) (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 38a (new)

Text proposed by the Commission

Amendment

(38a) ‘identifiable natural person’ means a natural person who can be identified, directly or indirectly, taking into account all the means reasonably likely to be used;

noyb's comment:

Largely the current understanding. No material change.

#982 Article 4 – point 38b (new) (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 38b (new)

Text proposed by the Commission

Amendment

(38b) 'non-identifiable natural person’, for a given entity, means a natural person whom that entity cannot identify taking into account the means reasonably likely to be used by that entity.

noyb's comment:

Subjective approach limits the scope of the GDPR and makes compliance highly complex.

#986 Article 4 – point 38c (new) (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 38c (new)

Text proposed by the Commission

Amendment

(38c) ‘pseudonymised data’ means personal data that have undergone technical, organisational or cryptographic privacy-enhancing measures designed to prevent the likelihood of attribution to a specific natural person while preserving their utility for lawful processing purposes, by contrast with anonymisation, which renders the data subject not or no longer identifiable.

noyb's comment:

Along current understanding.

#988 Article 4 – point 38d (new) (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 38d (new)

Text proposed by the Commission

Amendment

(38d) ‘state-of-the-art privacy-preserving and privacy-enhancing methods’ means recognised technical and organisational methods reflecting the state of the art that reduce or eliminate the attribution of data to a natural person, including pseudonymisation and key separation, encryption, aggregation and generalisation, the addition of statistical noise and differential privacy, synthetic data generation, secure multi-party computation and the use of secure processing environments.

Justification

Defines the recognised privacy-enhancing techniques on which the graded regime rests: pseudonymisation and key separation, encryption at rest and in transit, aggregation and generalisation, statistical noise and differential privacy, synthetic data, secure multi-party computation, secure processing environments, and contractual and organisational prohibitions on re-identification. The technical criteria are to be specified by implementing act, in cooperation with the EDPB, so as not to freeze in the Regulation a state of the art which is bound to evolve.

noyb's comment:

Mix of reasonable and less reasonable paths from a GDPR perspective (e.g. encryption is an existing Article 32 requirement).

#994 Article 5 – paragraph 1 – point b (Article 3 – paragraph 1 – point 2)

Authored by

Regulation (EU) 2016/679
Article 5 – paragraph 1 – point b

Text proposed by the Commission

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);

Amendment

noyb's comment:

The amendment reflects EDPB Guidelines 1/2026 and pushes back against the Commission's proposal of additional derogation to Article 6(4).

#1000 Article 5 – paragraph 2a (new) (Article 3 – paragraph 1 – point 2 a (new))

Authored by

Regulation (EU) 2016/679
Article 5 – paragraph 2a (new)

Text proposed by the Commission

Amendment

2a. In Article 5, the following paragraph 2a is inserted: '2a. Where a controller collects personal data from a third party, or purchases, aggregates, enriches, sells or otherwise makes personal data available to third parties for commercial purposes, it shall, as part of the measures referred to in Article 24, verify and document the lawful origin of the data, the legal basis for their initial collection and for any subsequent processing, the purposes for which they were collected, the categories of data and of data subjects concerned, the information provided pursuant to Articles 13 and 14 and, where applicable, the validity of the consent obtained. The controller shall not rely solely on a general declaration of compliance or on standard contractual terms supplied by the data provider. Verification shall be strengthened where the circumstances of the processing give rise to reasonable doubt as to the lawfulness of the collection or of the making available of the data, in particular where the data originate from an undisclosed or indeterminate source, where they concern a large number of data subjects, or where they have been obtained through successive transfers. Where the controller is unable to demonstrate that lawfulness, it shall refrain from processing or from continuing to process the data concerned, and from selling them or making them available to third parties.'

noyb's comment:

The amendment includes a new obligation for controllers intending to use third-party collected data for commercial purpose, to verify that such data has been processed in accordance with the GDPR.

#1013 Article 6 – Paragraph 1a (new) (Article 3 – paragraph 1 – point 2 d (new))

Authored by

Regulation (EU) 2016/679
Article 6 – Paragraph 1a (new)

Text proposed by the Commission

Amendment

2d. In Article 6, the following paragraph 1a is inserted: '(1a) For the purposes of paragraph 1, the creation of a permanent user account or the provision of personal data by the data subject may be required to access offers or to purchase goods or services only where strictly necessary. Where such access or purchase can be ensured without it, the controller shall offer the data subject a clear, easily accessible and non-discriminatory means to proceed, which shall not give rise to less favourable conditions for the data subject.'

Justification

Making access to an offer or the purchase of goods or services conditional on the creation of a permanent user account which is not necessary for the contract deprives consent of its free character, contrary to Article 7(4). The amendment requires the controller to offer a clear, easily accessible and non-discriminatory means to proceed without such an account, which may not give rise to less favourable conditions for the data subject. This is the 'guest experience' which the Court of Justice has already held to be required in comparable circumstances.

noyb's comment:

The proposed text includes an additional safeguard.

#1015 Article 6 – Paragraph 4a (new) (Article 3 – paragraph 1 – point 2 e (new))

Authored by

Regulation (EU) 2016/679
Article 6 – Paragraph 4a (new)

Text proposed by the Commission

Amendment

2e. In Article 6, the following paragraph 4a is inserted: '4a. Processing shall be regarded as necessary for the purposes of the legitimate interests pursued within the meaning of point (f) of paragraph 1 only where the following cumulative conditions are met: (a) the controller or a third party pursues a legitimate interest which is lawful, clearly and precisely articulated, and real and present rather than speculative; (b) the processing of personal data is necessary for that interest, and that interest cannot reasonably be achieved by other means less intrusive for the data subject, including through the use of anonymised, pseudonymised or synthetic data; (c) that interest is not overridden by the interests or fundamental rights and freedoms of the data subject, taking into account the nature of the data, the context of the processing, its possible consequences, and the reasonable expectations of the data subject based on their relationship with the controller. Where the interests or fundamental rights and freedoms of the data subject would override the interest pursued, the controller may implement technical and organisational measures to mitigate the impact of the processing on the data subject; where such measures are insufficient, the processing shall not be based on point (f) of paragraph 1.'

noyb's comment:

Codification of the current case law and understanding. However, the reference to "technical and organizational measures" may be understood as allowing processing beyond the current options.

#1016 Article 6 – Paragraph 4b (new) (Article 3 – paragraph 1 – point 2 f (new))

Authored by

Regulation (EU) 2016/679
Article 6 – Paragraph 4b (new)

Text proposed by the Commission

Amendment

2f. In Article 6, the following paragraph 4b is inserted: '4b. Where personal data are collected from publicly accessible sources by means of web scraping for the purposes of developing or training an artificial intelligence system or model, the processing may be based on point f of paragraph 1 only where the conditions set out in paragraph 1a are met. In assessing whether the interests or fundamental rights and freedoms of the data subject override the interest pursued, account shall be taken in particular of: (a) the nature of the data, greater weight being given to data revealing highly private information; (b) the context of the processing, including the volume of data, the number of data subjects and the indiscriminate character of the collection; (c) the consequences for the data subject, including the difficulty of exercising their rights once the model is trained; (d) the reasonable expectations of the data subject, having regard to the nature of the source, the publicly accessible character of the data, whether the data subject has manifestly made the data public, and any technical restriction by which the source opposes scraping. Consent shall not be inferred from the mere online accessibility of personal data, nor from the absence of a technical measure opposing scraping. Where the interests or fundamental rights and freedoms of the data subject would override the interest pursued, the controller may implement mitigating measures, including limiting collection to freely accessible data, excluding sources that oppose scraping, facilitating the right to object including prior to collection, and deleting or anonymising personal data as soon as possible; where such measures are insufficient, the processing shall not be based on point f of paragraph 1.'

Justification

Where personal data are collected from publicly accessible sources by means of web scraping for the purpose of developing or training an artificial intelligence system, reliance on legitimate interest remains subject to the conditions of Article 6(1a). The balancing test takes particular account of the nature of the data, the volume and indiscriminate character of the collection, the difficulty for the data subject of exercising their rights once the model is trained, and the reasonable expectations of the data subject, having regard to the nature of the source and to any technical restriction opposing scraping. The mere online accessibility of personal data does not constitute consent, nor does the absence of a robots.txt file. This codifies the EDPB Guidelines 03/2026.

noyb's comment:

The amendment includes a derogation in relation to web scraping, by incorporating CJEU case-law, which is not foreseen in the current regime.

#1017 Article 7a (new) (Article 3 – paragraph 1 – point 2 g (new))

Authored by

Regulation (EU) 2016/679
Article 7a (new)

Text proposed by the Commission

Amendment

2g. The following Article 7a is inserted: 'Article 7a Consent interfaces 1. Any interface used to request, give, refuse or withdraw consent under this Regulation, including for the storing of, or access to, information in terminal equipment, shall be fair, neutral, intelligible and easily accessible. 2. Consent shall be freely given, specific, informed and unambiguous. It shall be requested separately for each purpose and require a statement or clear affirmative action. Silence, inactivity, pre-ticked boxes or the mere continued use of a service shall not constitute consent. Fresh consent shall be required for any other purpose. 3. Consent shall not be freely given where the data subject has no genuine choice, cannot refuse or withdraw consent without detriment, including in the presence of a clear imbalance between the data subject and the controller, or where access to a service, its functionalities or an equivalent version thereof is made conditional on consent to processing, storing or access that is not necessary for that service. 4. Before consent is given, the data subject shall receive, in clear and plain language, information on the controller, any joint controllers, recipients or categories of recipients relying on the consent, the purposes pursued, the categories of data concerned, the right to withdraw consent, and, where relevant, automated decision-making under Article 22 or transfers to a third country without an adequacy decision or appropriate safeguards. Consent requests shall be clearly distinguishable from other matters and shall not be concealed within general terms and conditions. 5. Consent interfaces shall not deceive, coerce or manipulate the data subject, give greater prominence to acceptance than to refusal, make refusal, withdrawal or non-consent options less easy, less accessible or more time-consuming than acceptance, or repeat requests in a manner liable to pressure the data subject. Where an option to accept is presented, an equivalent option to refuse shall be presented at the same level of the interface. 6. Refusing or withdrawing consent shall be as easy as giving consent and shall not entail any cost, disadvantage or degradation of the service. Where consent was given through an electronic interface, withdrawal shall be possible through the same interface. Following withdrawal, the controller shall cease the processing concerned and, in the absence of another lawful basis, erase the data concerned. 7. Where consent is withdrawn or found to be invalid, the controller shall not retroactively rely on another legal basis under Article 6 to justify the same processing. 8. The controller shall be able to demonstrate that valid consent was given. The information retained for that purpose shall be limited to what is necessary. 9. Where this Regulation requires explicit consent, consent shall be given by an express statement.'

Justification

Codifies the EDPB Guidelines 05/2020 on consent and 03/2022 on deceptive design patterns. Consent must be freely given, specific, informed and unambiguous; the interface must be fair and neutral and must not give visual or other prominence to acceptance over refusal, whether through size, colour, positioning or wording; refusal must be as easy to exercise, and as prominent, as acceptance; consent must be capable of being withdrawn as easily as it was given; and the controller may not retroactively rely on another legal basis where consent is withdrawn or found invalid. Consent obtained through a manipulated interface is not consent.

noyb's comment:

Different clarifications, also case-law reflected here.

#1024 Article 9 – paragraph 2 – point k (Article 3 – paragraph 1 – point 3 – point a)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k

Text proposed by the Commission

(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.

Amendment

(k) processing in the context of the development and operation of an innovative system or technology that is necessary for the legitimate interests pursued by the controller or by a third party, whether or not such system or technology exists at the time of adoption of this Regulation, of which an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model is a current example, subject to the conditions referred to in paragraph 5, and without prejudice to the prohibited practices laid down in Article 5 of Regulation (EU) 2024/1689, the classification rules for high-risk AI systems laid down in Article 6, the obligations of deployers of high-risk AI systems laid down in Article 26, and the transparency obligations laid down in Article 50 of that Regulation.

noyb's comment:

This proposed amendment suggests that there is an even wider allowance for processing of sensitive personal data from innovative systems/technologies.

#1038 Article 9 – paragraph 2 (Article 3 – paragraph 1 – point 3 – point a)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 2

Text proposed by the Commission

(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.

Amendment

(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the one-to-one verification is under the sole control of the data subject.

noyb's comment:

The amendment supports the Commission's proposal.

#1046 Article 9 – paragraph 2a (new) (Article 3 – paragraph 1 – point 3 – point a a (new))

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 2a (new)

Text proposed by the Commission

Amendment

(aa) In Article 9, the following paragraph is inserted: '2a. Points k and k under paragraph 2 shall not apply to data concerning health, genetic data, biometric data for the purpose of uniquely identifying a natural person, or personal data used to infer health status, unless such processing is expressly authorised by Union or Member State law and subject to prior consultation with the competent supervisory authority.'

noyb's comment:

Limits, but also accepts the additions in (k) proposed by the Commission.

#1052 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 5

Text proposed by the Commission

Amendment

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data, without undue delay. In assessing whether the removal of those data requires a disproportionate effort, account shall be taken of the state of the art, the costs of implementation, the volume of data concerned, the technical feasibility of isolating or extracting the data, and the nature, scope and purposes of the processing. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data is technically impossible despite documented state-of-the-art measures, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, or re-used for AI outputs, profiling, advertising or other purposes, and from being disclosed or otherwise made available to third parties. In assessing whether the removal of those data requires a disproportionate effort, account shall be taken of the state of the art, the costs of implementation, the volume of data concerned, the technical feasibility of isolating or extracting the data, and the nature, scope and purposes of the processing; or re-used for AI outputs, profiling, advertising or other purposes,

Justification

A general AI derogation should not create a route for the incidental use of patient or health-related data. Health data require a specific legal basis, stronger safeguards and effective supervisory oversight. The same carve-out should be reflected in proposed Article 88c on legitimate interests for AI processing.

noyb's comment:

Reiterates a limitations that would typically already apply under the general principles in the current text of the GDPR. Some matters like the "technical impossibility" are currently not a defense for controllers (so far the processing is then simply not possible) and are added here.

#1054 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 5

Text proposed by the Commission

Amendment

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties. The controller shall apply effective technical and organisational measures to prevent their inference, disclosure or use. Those measures shall reflect the state of the art and shall include, as appropriate, the filtering and removal of such data from training, testing and validation datasets, pseudonymisation and key separation, and technical measures preventing their inference, regurgitation or disclosure through the outputs of the AI system or model; their application shall be proportionate to the risk and shall be documented by the controller.

noyb's comment:

The amendment rephrases the Commission's proposal, while adding some examples of technical measures.

#1058 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 5

Text proposed by the Commission

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

Amendment

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to mitigate the risk of the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller is notified of or identifies special categories of personal data relating to specific data subjects in the aforementioned datasets used for training, testing or validation or in the AI system or AI model, the controller shall implement technically and economically feasible measures to cease processing of those special categories of personal data for the purpose of training or developing an AI system or AI model. If cessation of processing requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

Justification

The current wording of Article 9(5), requiring controllers to “avoid” the collection and processing of special categories of personal data, may be interpreted too broadly and create the expectation that controllers must eliminate such data entirely in advance. In practice, this is often not feasible, especially where large and diverse datasets are used for training and testing AI systems, and thus it could hinder AI development where appropriate safeguards are already in place. The amendment therefore replaces this overly rigid standard with a more proportionate obligation to mitigate the risk through appropriate technical and organisational measures. This approach is consistent with Article 25 - the principle of data protection by design and by default. At the same time, it preserves the duty to act where the controller is notified of, or identifies, the presence of such data - thereby covering situations in which the relevant data is brought to the controller's attention by third parties, and not only cases of self-identification. Where cessation of processing would require disproportionate effort, the controller shall implement technically and economically feasible measures to protect the data from being used to produce outputs or otherwise made available to third parties. This standard avoids imposing obligations that are impossible to fulfil in practice and is in line with the GDPR framework.

noyb's comment:

The amendment includes more derogations than the Commission's proposal.

#1063 Article 9 – paragraph 5a (new) (Article 3 – paragraph 1 – point 3 – point b)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 5a (new)

Text proposed by the Commission

Amendment

5a. 'Where the processing referred to in point k of paragraph 2 is carried out in the context of an AI regulatory sandbox established under Article 57 of Regulation (EU) 2024/1689, or in the context of testing in real world conditions under Article 60 of that Regulation, the processing shall comply with the conditions and safeguards laid down, respectively, in Article 59 and in Articles 60 and 61 of that Regulation. In particular, the personal data shall be processed in a functionally separate, isolated and protected environment under the control of the controller; effective monitoring and response mechanisms shall be in place to identify and mitigate high risks to the rights and freedoms of the data subjects and, where necessary, to stop the processing; and any personal data shall be deleted once the participation in the sandbox or the testing has terminated.'

Justification

The processing of personal data for the development of AI systems must be accompanied by robust safeguards, in particular as regards special categories of personal data. This amendment specifies the organisational and technical measures to be implemented, provides objective criteria for assessing whether the removal of inadvertently collected special categories of data would require a disproportionate effort, and subjects the removal itself to a requirement of promptness. It further establishes a graduated approach: where the processing takes place within an AI regulatory sandbox or in the course of testing in real world conditions, it must comply with the conditions and safeguards laid down, respectively, in Articles 59, 60 and 61 of Regulation (EU) 2024/1689, thereby importing the risk-control mechanisms of that Regulation — isolated processing environments, effective monitoring and response mechanisms, and deletion upon completion. Where the controller is a small or medium-sized enterprise or a small mid-cap, the measures are to be applied in a manner adapted to its capacities, without reducing the protection afforded to data subjects. This ensures coherence with the Artificial Intelligence Act while supporting innovation, in particular by smaller Union operators.

noyb's comment:

The proposed amendment does add slightly what is already lex specialis in the AI Act.

#1066 Article 9 – paragraph 5b (new) (Article 3 – paragraph 1 – point 3 – point b)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 5b (new)

Text proposed by the Commission

Amendment

5b. In Article 9, the following paragraph 5b is inserted: '5b. Where the controller is a small or medium-sized enterprise or a small mid-cap, the organisational and technical measures referred to in this paragraph shall be applied in a manner adapted to its size and capacities, without reducing the level of protection afforded to data subjects and, in particular, without affecting the obligation to remove or effectively protect special categories of personal data. Competent authorities shall provide such enterprises with guidance to that effect.'

noyb's comment:

This amendment proposes simpler obligations for SMEs regarding technical measures for special categories of personal data.

#1067 Article 9 – paragraph 5c (new) (Article 3 – paragraph 1 – point 3 a (new))

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 5c (new)

Text proposed by the Commission

Amendment

3a. In Article 9, the following paragraph 5c is inserted: '5c. Where, in the course of web scraping from publicly accessible sources for the purposes of developing or training an artificial intelligence system or model, special categories of personal data are collected incidentally and residually, without the controller intending to collect them, the prohibition laid down in paragraph 1 shall apply to that controller only within the framework of its responsibilities, powers and capabilities, provided that: (a) the processing has relevant similarities with the processing carried out by a search engine operator; (b) the processing of special categories of personal data is only incidental and residual, and no such processing is intentional; (c) it is difficult or impossible to assess, before collection, whether and to what extent the processing includes special categories of personal data; and (d) the controller implements measures, within the framework of its responsibilities, powers and capabilities, to prevent the collection and the dissemination of such data. The measures referred to in point (d) shall include, at least: defining precise criteria and applying filters to prevent collection before collection, and excluding sources structurally containing such data; deleting such data immediately after collection or as soon as identified, including upon a request by the data subject constituting a plausible indication that the data fall under paragraph 1; preventing the extraction of such data from the model and ensuring state-of-the-art resistance to privacy attacks during development; and monitoring the output of the system after development, applying output filters and, where available, model unlearning. The controller shall be able to demonstrate that these conditions are met and shall regularly verify the effectiveness of the measures.'

noyb's comment:

The proposed amendment is aiming to codify CJEU case-law (GC and Others, C-136/17). However this case was about de-referencing personal data by a search engine and not an AI system or model.

#1079 Article 12 – paragraph 5 (Article 3 – paragraph 1 – point 4)

Authored by

Regulation (EU) 2016/679
Article 12 – paragraph 5

Text proposed by the Commission

Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either:

Amendment

Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the means at their disposal to enforce the rights conferred by this regulation for purposes unrelated to the protection of their data, the controller may refuse to act on the request, and inform the data subject of the reasons thereof.

noyb's comment:

The amendment supports the Commission's proposal which restricts the right to access in violation of Article 8(2) of the Charter.

#1083 Article 12 – paragraph 5 – point a (Article 3 – paragraph 1 – point 4)

Authored by

Regulation (EU) 2016/679
Article 12 – paragraph 5 – point a

Text proposed by the Commission

(a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

Amendment

deleted

noyb's comment:

The amendment restrains the right to access by removing the possibility for the data subject to pay a reasonnable fee.

#1085 Article 12 – paragraph 5 – point b (Article 3 – paragraph 1 – point 4)

Authored by

Regulation (EU) 2016/679
Article 12 – paragraph 5 – point b

Text proposed by the Commission

(b) refuse to act on the request.

Amendment

deleted

noyb's comment:

The amendment improves the current regime.

#1087 Article 12 – paragraph 5 – second subparagraph (Article 3 – paragraph 1 – point 4)

Authored by

Regulation (EU) 2016/679
Article 12 – paragraph 5 – second subparagraph

Text proposed by the Commission

Amendment

A request may in particular be regarded as excessive within the meaning of the first subparagraph where the means at the disposal of the data subject are used for the purpose of obtaining commercially sensitive information or gaining insight into the internal processes of the controller, including for the benefit of an undertaking competing with the controller, of exerting pressure in unrelated proceedings, or of disrupting the administrative operations of the controller by imposing a manifestly disproportionate burden.

Justification

Specifies the circumstances in which a request may be regarded as excessive: obtaining commercially sensitive information or gaining insight into the internal processes of the controller, including for the benefit of a competing undertaking; exerting pressure in unrelated proceedings; disrupting the administrative operations of the controller by imposing a manifestly disproportionate burden. The criterion is the manifest diversion of purpose, not the mere inconvenience caused to the controller.

noyb's comment:

The amendment restricts the right to access compared to the current regime, as interpreted by the CJEU in C-526/24 Brillen Rottler.

#1088 Article 12 – paragraph 5 – third subparagraph (Article 3 – paragraph 1 – point 4)

Authored by

Regulation (EU) 2016/679
Article 12 – paragraph 5 – third subparagraph

Text proposed by the Commission

Amendment

In Article 12, paragraph 5, the following subparagraph is added: 'The exercise of the rights conferred by this Regulation for the purpose of verifying, in good faith, whether a controller complies with this Regulation shall not be regarded as unfounded or excessive, irrespective of whether those rights are exercised individually or with the assistance of, or through, a body referred to in Article 80.'

noyb's comment:

The amendment adds a condition of good faith that restricts the right to access in a way incompatible with the Charter.

#1099 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)

Authored by

Regulation (EU) 2016/679
Article 13 – paragraph 4

Text proposed by the Commission

5. In Article 13, paragraph 4 is replaced by the following: ‘4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.’

Amendment

deleted

noyb's comment:

Deletion of Commission's proposal.

#1108 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)

Authored by

Regulation (EU) 2016/679
Article 13 – paragraph 4

Text proposed by the Commission

Amendment

4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and the controller is able to demonstrate that the data subject already has the information referred to in points (a), (c) and (d) of paragraph 1. Where the controller intends to carry out processing for which the information referred to in points (e) and (f) of paragraph 1 is required, such as transmitting the data to other recipients or categories of recipients, transfering the data to a third country, carrying out automated decision-making, including profiling, referred to in Article 22(1), or where the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35, the controller shall provide that information to the data subject. This exemption shall not apply where processing concerns data relating to health, data inferred from medicine- or pharmacy-related interactions, profiling, direct marketing or disclosure to another recipient.

noyb's comment:

Building upon the Commission’s proposal, this amendment similarly allows for further cases where no information to data subjects is provided (even if it tires to improve the proposal from a privacy perspective). As does the COM proposal, this provision provides for a rather complex set of rules which unlikely to work in practice. A lack of information typcially violates the "fairness" principle in Article 8(2) of the Charter.

#1113 Article 13 – paragraph 4a (new) (Article 3 – paragraph 1 – point 5)

Authored by

Regulation (EU) 2016/679
Article 13 – paragraph 4a (new)

Text proposed by the Commission

Amendment

4a. In Article 13, the following paragraph is inserted: '4a. An activity is circumscribed and not data-intensive where the processing of personal data is ancillary to the main activity of the controller and is limited in volume, scope and purposes. Such relationships include, in particular: (a) the relationship between a data subject and a professional bound by a legal or ethical obligation of confidentiality, such as a lawyer, physician or notary, acting within the scope of that relationship; (b) the commercial relationship between a customer and a trader in the context of the provision of a specific good or service requested by the data subject, provided that the customer list is used solely as an internal management tool and is not intended to be disclosed or monetised to third parties; (c) the non-commercial relationship between a member and an association, or between an employee and an employer, insofar as the processing is limited to what is necessary for that relationship.'

Justification

Extends the derogation from the information obligation to circumscribed relationships in which the controller's activity is not data-intensive: associations, sport clubs, micro, small and medium-sized enterprises where processing is confined to the management of membership, communication with members, the organisation of activities or the performance of a contract. The derogation is expressly excluded where the controller engages in data brokerage, which is by nature data-intensive.

noyb's comment:

A clarification related to the additional exemption from the information obligation in the proposed Article 13(4). On its own, contrarty to the amendment of Article 13(4), this amendment does not reduce the level of provicy. Compared to the current version of the GDPR it provides a lower level of protection. For relevant controllers it could simplify complaince. A lack of information typcially violates the "fairness" principle in Article 8(2) of the Charter.

#1124 Article 13 – paragraph 5 (Article 3 – paragraph 1 – point 6)

Authored by

Regulation (EU) 2016/679
Article 13 – paragraph 5

Text proposed by the Commission

5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.

Amendment

Justification

The exemption from the information obligations for scientific research purposes must not operate to the detriment of the safeguards applicable to the processing of personal data in the context of AI development. This amendment specifies that paragraph 5 is without prejudice to the conditions and safeguards laid down in Articles 59, 60 and 61 of Regulation (EU) 2024/1689 governing AI regulatory sandboxes and testing in real world conditions — in particular the requirements relating to isolated processing environments, monitoring and response mechanisms, deletion of data, and informed consent — which continue to apply. This ensures the coherence of the Union acquis and prevents the research exemption from being used to circumvent the risk-control obligations of the Artificial Intelligence Act.

noyb's comment:

This proposal builds upon the Commission's proposal and only adds a clarification for sandboxes.

#1156 Article 22 – Paragraph 1a (new) (Article 3 – paragraph 1 – point 7)

Authored by

Regulation (EU) 2016/679
Article 22 – Paragraph 1a (new)

Text proposed by the Commission

Amendment

1a. In Article 22, the following paragraph is inserted: '1a. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.'

noyb's comment:

This proposal returns the right not to be subject to ADM. Apparently, without the previous exemptions. While this would be much stricter, it would provide for legal certainty.

#1157 Article 22 – paragraph 1b (new) (Article 3 – paragraph 1 – point 7)

Authored by

Regulation (EU) 2016/679
Article 22 – paragraph 1b (new)

Text proposed by the Commission

Amendment

1b. In Article 22, the following paragraph is inserted: '1b. Where a decision referred to in paragraph 1 is based on the output of a high-risk AI system within the meaning of Regulation (EU) 2024/1689, the measures referred to in point (b) of paragraph 1, and the safeguards accompanying a decision taken pursuant to points (a) and (c) thereof, shall be without prejudice to the human oversight requirements laid down in Article 14 of that Regulation. In particular, natural persons to whom human oversight is assigned shall be enabled to properly understand the capacities and limitations of the system, to correctly interpret its output, to remain aware of the risk of over-reliance on that output, and to decide not to use the system or to disregard, override or reverse its output. Automated processing shall not deprive the data subject of the right to obtain human intervention, to express his or her point of view and to contest the decision.'

Justification

Decisions based solely on automated processing that produce legal effects or similarly significantly affect a data subject raise particular risks where they rely on the output of a high-risk AI system. This amendment clarifies that, in such cases, the safeguards under Article 22 are without prejudice to the human oversight requirements laid down in Article 14 of Regulation (EU) 2024/1689: the natural persons to whom oversight is assigned must be able to understand the system's capacities and limitations, to interpret its output correctly, to remain aware of the risk of over-reliance, and to disregard, override or reverse that output. It further recalls that automated processing may not deprive the data subject of the right to obtain human intervention, to express his or her point of view and to contest the decision. This ensures the coherence of the Union acquis by articulating the structural obligation of human oversight under the Artificial Intelligence Act with the individual right to human intervention under the General Data Protection Regulation.

noyb's comment:

Positive clarification.

#1165 Article 30 – Paragraph 1 – point ga (new) (Article 3 – paragraph 1 – point 7 a (new))

Authored by

Regulation (EU) 2016/679
Article 30 – Paragraph 1 – point ga (new)

Present text

(new)

Amendment

7a. In Article 30, paragraph 1, the following point ga is added: "(ga) where personal data are collected from a third party, purchased, aggregated, enriched, sold or otherwise made available to third parties for commercial purposes, the categories of data providers and of data recipients, the categories of data concerned, the purposes pursued, the legal basis relied upon, and the elements demonstrating the lawful origin of the data and of their making available. The identity of the providers and recipients concerned shall be retained by the controller and made available to the supervisory authority upon request."

noyb's comment:

The proposed text seeks to codify additional safeguards in the GDPR. This would lead to additional documentation duties.

#1169 Article 29a (new) (Article 3 – paragraph 1 – point 7 b (new))

Authored by

Regulation (EU) 2016/679
Article 29a (new)

Present text

(new)

Amendment

7b. The following article is added: "Article 29a Application of pseudonymisation and identification of a natural person : 1. Controllers and processors may apply pseudonymisation in order to reduce the risks to the data subjects concerned and to comply with their obligations under this Regulation, in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information. The Commission may adopt implementing acts to specify means and criteria to determine whether a natural person is identifiable, including through personal data having undergone data resulting from pseudonymisation, account shall be taken of all the means reasonably likely to be used, such as singling out or online identifiers, either by the controller or by another person to identify the natural person directly or indirectly no longer constitutes personal data for certain entities. 2. The application of pseudonymisation to personal data may, depending on the circumstances of the case and provided that appropriate technical and organisational measures are put in place and are such as to prevent the data in question from being attributed to the data subject, effectively prevent persons other than the controller from identifying the data subject in such a way that, for them, the data subject is not or is no longer identifiable. 3. Where a person other than the controller referred to in paragraph 2 discloses, transmits or otherwise makes such data available to a third party and it cannot be ruled out that this third party possesses or can obtain means reasonably likely to enable the data subject to be identified, both the transmission of the data to this third party and the subsequent processing of the data by this third party is to be considered as processing of data relating to an identifiable natural person."

noyb's comment:

Pseudonymisation is an unreliable safeguard in preventing identification of a data subject. Further, wording such as “reasonably likely to be used” allows for an unclear, subjective and circumstantial definition of personal data.

#1177 Article 33 – Paragraph 1 (Article 3 – paragraph 1 – point 8 – point a)

Authored by

Regulation (EU) 2016/679 (GDPR)
Article 33 – Paragraph 1

Text proposed by the Commission

1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.

Amendment

1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via their national single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay. Controllers shall continue to document non-notified breaches, including the facts relating to the personal data breach, its effects and the remedial action taken.

Justification

The controller documents every personal data breach, including those which are not notified. The documentation comprises the facts relating to the breach, its effects and the remedial action taken, and enables the supervisory authority to verify compliance in the course of an inspection.

noyb's comment:

No material changes to the Commission's proposal.

#1189 Article 33 – Paragraph 1a (Article 3 – paragraph 1 – point 8 – point b)

Authored by

Regulation (EU) 2016/679
Article 33 – Paragraph 1a

Text proposed by the Commission

(b) the following paragraph is added: ‘1a. Until the establishment of the single-entry point pursuant to Article 23a of Directive (EU) 2022/2555, controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article 56.’

Amendment

deleted

noyb's comment:

Deletion of the Commission’s proposal. Probably connected to a proposal deleting the obligation to notify via the single-entry point.

#1190 Article 33 – Paragraph 1a (Article 3 – paragraph 1 – point 8 – point b)

Authored by

Regulation (EU) 2016/679
Article 33 – Paragraph 1a

Text proposed by the Commission

1a. Until the establishment of the single-entry point pursuant to Article 23a of Directive (EU) 2022/2555, controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article 56.

Amendment

deleted

noyb's comment:

Deletion of the Commission’s proposal. Probably connected to a proposal deleting the obligation to notify via the single-entry point.

#1191 Article 33 – Paragraph 6 (Article 3 – paragraph 1 – point 8 – point c)

Authored by

Regulation (EU) 2016/679
Article 33 – Paragraph 6

Text proposed by the Commission

Amendment

6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The common template shall include fields enabling the controller to describe any privacy-enhancing measures relevant to the breach, including encryption, pseudonymisation, federated or local processing, confidential computing, access controls, logging, and measures taken to prevent model memorisation, regurgitation, or unauthorised disclosure. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2). Where the Commission departs from the proposal submitted by the Board, it shall state the reasons for doing so. Those reasons shall be made publicly available together with the implementing act.

noyb's comment:

No substantial amendment of the Commission’s proposal regarding the list and template the EDPB is supposed to prepare.

#1198 Article 33 – Paragraph 7 (Article 3 – paragraph 1 – point 8 – point c)

Authored by

Regulation (EU) 2016/679
Article 33 – Paragraph 7

Text proposed by the Commission

Amendment

7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6. Where the Commission departs from the Board's proposals for updates, it shall state the reasons for doing so, and those reasons shall be made publicly available together with the adopted updates.

noyb's comment:

No material changes to the Commission’s proposal. Only a transparency part is added in case the Commission departs from the EDPB’s opinion.

#1220 Article 35 – Paragraph 6a (new) (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – Paragraph 6a (new)

Text proposed by the Commission

Amendment

6a. In Article 35, the following paragraph is inserted: '6a. The common template and methodology for data protection impact assessments shall require the controller to assess: (a) the risk of re-identification, including by algorithmic means and taking into account the means reasonably likely to be used; (b) the availability and suitability of state-of-the-art privacy-preserving and privacy-enhancing techniques to remove or mitigate that risk, including pseudonymisation, encryption, aggregation, synthetic data, federated analysis and secure processing environments; and (c) the residual risk after application of such techniques.'

noyb's comment:

This proposal requires controllers to take certain aspects into account while performing a DPIA. This would add some administrative burden. While this can only mean that these aspects have to be taken in account in addition to other factors rather than exclusively, it provides for some additional legal uncertainty. The level of privacy remains practically unaffected.

#1223 Article 35 – Paragraph 6b (Article 3 – paragraph 1 – point 9 – point a a (new))

Authored by

Regulation (EU) 2016/679
Article 35 – Paragraph 6b

Text proposed by the Commission

Amendment

(aa) In Article 35, the following paragraph is inserted: '6b. The proposals referred to in paragraphs 4, 5 and 6 shall be without prejudice to the right of the competent authorities and supervisory authorities of the Member States to develop their own guidance, standards and lists, in particular the lists referred to in Article 35(4) and (5). The Board shall take such national guidance, standards and lists into account when preparing the common templates, methodology and lists referred to in those paragraphs.'

Justification

The preparation by the Board of common templates, a common methodology and common lists relating to data protection impact assessments contributes to a consistent application of this Regulation. However, this harmonisation of form should not deprive the competent authorities and supervisory authorities of the Member States of their power — recognised in particular in Article 35(4) and (5) — to develop their own guidance, standards and lists reflecting national circumstances. This amendment confirms that the proposals referred to in paragraphs 4, 5 and 6 are without prejudice to that power, and provides that the Board shall take such national guidance, standards and lists into account when preparing the common instruments. This ensures a bottom-up articulation between the national and Union levels, preserving both consistency and the ability of national authorities to address specific national risks.

noyb's comment:

The parallel establishment of lists by the EDPB and national authorities increases the workload for these organisations as well as the administrative workload for controllers in monitoring and complying with different lists/templates.

#1233 Article 35 – paragraph 6c (Article 3 – paragraph 1 – point 9 – point b)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 6c

Text proposed by the Commission

Amendment

6ca. In Article 35, the following paragraph is inserted: '6c. A data protection impact assessment shall not be required, on the sole basis of the Union list referred to in Article 35(4), for processing operations that were already underway before [the date of application of that list], provided that those operations have not since been subject to substantial modification. This is without prejudice to the obligation to carry out an assessment where processing is likely to result in a high risk on other grounds under Article 35(1).'

noyb's comment:

This proposal aims at narrowing the scope of processing activities for which a DPIA has to be performed, lowering the level of data protection. The reduction of administrative workload for the performance of a DPIA is such cases is offset by the massive legal uncertainty in these cases as it would be unlikely that a court or DPA would consider that there is no high risk if the processing is covered by the list established by the EDPB.

#1235 Article 35 – paragraph 7a (new) (Article 3 – paragraph 1 – point 9 a (new))

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 7a (new)

Text proposed by the Commission

Amendment

9a. In Article 35, the following paragraph 7a is inserted: '7a. Where, in respect of the same processing operation or activity, the controller is required to carry out a data protection impact assessment under this Article and is also subject to an obligation to carry out a fundamental rights impact assessment under Article 27 of Regulation (EU) 2024/1689, or to a reporting obligation in respect of automated monitoring or decision-making systems under other Union law, those obligations may be satisfied by means of a single integrated assessment. The integrated assessment shall be deemed to satisfy each of those obligations only where it covers all the elements required by each applicable provision. The substantive requirements, thresholds and triggering conditions laid down in those provisions remain unaffected. A data protection impact assessment carried out under this Article that addresses the elements required for the fundamental rights impact assessment under Article 27 of Regulation (EU) 2024/1689 shall be relied upon in accordance with Article 27(4) of that Regulation, without duplication. The integrated assessment shall be made available to each competent authority within the framework of its respective competences. This paragraph does not modify the allocation of supervisory competences under the acts referred to in the first subparagraph, nor does it require submission of the assessment to a single authority.'

Justification

Where, for the same processing operation, a controller must carry out a data protection impact assessment under Article 35 and a fundamental rights impact assessment under Article 27 of Regulation (EU) 2024/1689, or a reporting obligation in respect of automated monitoring systems, those obligations may be satisfied by a single integrated assessment. The assessment satisfies each obligation only where it covers all the elements required by each provision; the substantive requirements, thresholds and triggering conditions remain unaffected. The assessment is made available to each competent authority within its respective competences and is not submitted to a single authority: the documentary instrument is mutualised, not the supervisory competence.

noyb's comment:

Combining the DPIA with other assessments like the FRIA could reduce the administrative burden of controllers. The seemingly contradictory statements about providing the assessment to authorities do not completely offset this simplification.

#1239 Article 37 – paragraphs 2a and 4a (new) (Article 3 – paragraph 1 – point 9 b (new))

Authored by

Regulation (EU) 2016/679
Article 37 – paragraphs 2a and 4a (new)

Text proposed by the Commission

Amendment

9b. In Article 37, paragraphs 2a and 4a are inserted: '2a. Microenterprises, small and medium-sized enterprises within the meaning of Recommendation 2003/361/EC, and small mid-cap enterprises may jointly designate a single data protection officer, whether or not they are partner or linked enterprises, provided that the data protection officer is easily accessible from each of them and is able to perform his or her tasks effectively in respect of each participating enterprise, taking into account the nature, scope, context and purposes of their respective processing operations. The participating enterprises shall specify, in a written arrangement, the allocation of responsibilities and the resources made available to the shared data protection officer.'; '4a. Member States may provide that a public body designated for that purpose makes available data protection officers acting for a pool of microenterprises, small and medium-sized enterprises or small mid-cap enterprises. A data protection officer made available under this paragraph shall perform the tasks referred to in Article 39 independently, in accordance with Article 38, and shall not receive instructions regarding the exercise of those tasks. This paragraph shall not apply to the supervisory authorities referred to in Article 51, so as to avoid any conflict of interest.';

Justification

The cost of a dedicated data protection officer is prohibitive for small structures. The amendment allows micro, small and medium-sized enterprises and small mid-caps which are not related undertakings to designate a single data protection officer jointly, provided that the officer is easily accessible from each establishment and that the conditions of independence and absence of conflict of interest are met in respect of each controller concerned. Pooling reduces compliance costs without lowering the level of protection.

noyb's comment:

According to this proposal, SMEs should be able to jointly designate a single data protection officer. Also, a Member States should be able to establish a public body that makes available DPO for SMEs. In general, the former idea is very similar to external DPOs which is already possible. While appointing a DPO under such a systems would create the need to conclude more/different agreements, the additional complexity is (compared to appointing external DPOS) probably not significant.

#1241 Article 38 – paragraph 6 (Article 3 – paragraph 1 – point 9 c (new))

Authored by

Regulation (EU) 2016/679
Article 38 – paragraph 6

Present text

6. The data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests.

Amendment

9c. In Article 38 paragraph 6 is replaced by the following: "6. The data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests. Where a data protection officer is shared by several enterprises pursuant to Article 37(2a), or made available by a public body pursuant to Article 37(4a), the absence of a conflict of interests and the independence of the data protection officer shall be ensured in respect of each participating enterprise."

noyb's comment:

This would only be a clarification in case of specific joint DPOs for SMEs without significant impact on privacy or complexity.

#1242 Article 39 – paragraph 2 (Article 3 – paragraph 1 – point 9 d (new))

Authored by

Regulation (EU) 2016/679
Article 39 – paragraph 2

Present text

2. The data protection officer shall in the performance of his or her tasks have due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing.

Amendment

9d. in Article 39 paragraph 2 is replaced by the following: "2. The data protection officer shall in the performance of his or her tasks have due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing, including, where the data protection officer acts for several enterprises pursuant to Article 37(2a) or (4a), the specific processing operations of each of them."

noyb's comment:

No real material change, just a clarification for certain jointly appointed DPOs (introduced in the same set of amendments).

#1251 Article 41a – Paragraph 1 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – Paragraph 1

Text proposed by the Commission

(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.

Amendment

(1) The Commission shall be empowered to adopt guidelines specifying technical and organisational measures, including consent-management mechanisms, privacy-preserving technologies and privacy-enhancing techniques, that may be taken into account when assessing whether a controller, processor, data holder or data recipient has means reasonably likely to be used to identify a natural person and comply with its consent requesting obligations. Those guidelines shall be adopted in close cooperation with the European Data Protection Board and shall aim to promote legal certainty, interoperability and the consistent application of this Regulation across the Union. The adoption of those guidelines acts shall be without prejudice to the interpretation of Union law by the Court of Justice of the European Union, including as regards the concepts of personal data, identifiable natural person, pseudonymised data, anonymisation and means reasonably likely to be used.

noyb's comment:

The amendment expands the powers of the Commission and limits those of the EDPB, which, according to Article 8(3) of the CFR, is illegal. Thus, the current amendment by the Parliament diminishes fundamental rights more than the Commission's proposal.

#1288 Article 41a – Paragraph 3 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – Paragraph 3

Text proposed by the Commission

(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.

Amendment

(3) The implementation by a controller, processor, data holder or data recipient of the technical and organisational measures and criteria set out in the guidelines referred to in paragraph [1] may be relied upon as an element to demonstrate that the data are not, or are no longer, likely to lead to the re-identification of the data subjects, and that the person concerned has complied with its obligations, including its consent-requesting obligations, under this Regulation. Such reliance shall be without prejudice to the assessment of the specific circumstances of each case by the competent supervisory authority and to the interpretation of Union law by the Court of Justice of the European Union.

noyb's comment:

The amendment improves the Commission's proposal but remains a decrease of protection compared to the current accepted interpretations of Article 4(1) and Article 4(5).

#1298 Article 41a – Paragraph 5 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – Paragraph 5

Text proposed by the Commission

(5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).

Amendment

deleted

noyb's comment:

The amendment does not include any new substantive element.

#1301 Article 41b (new) (Article 3 – paragraph 1 – point 10 a (new))

Authored by

Regulation (EU) 2016/679
Article 41b (new)

Text proposed by the Commission

Amendment

10a. The following Article 41b is inserted: 'Article 41b Guidelines on the recipient-specific assessment of data resulting from pseudonymisation 1. The European Data Protection Board established by Article 68 of Regulation (EU) 2016/679 shall issue guidelines on the application of Article 4, point (1), to data resulting from pseudonymisation, in particular where such data are disclosed to a recipient and may be considered not to constitute personal data for that recipient. 2. Those guidelines shall address, in particular: (a) the criteria for assessing whether a recipient is realistically able to identify the data subject, either from the data alone or by combining the data with other information reasonably available to it; (b) the information, documentation and commitments that may be provided by the recipient concerning its means, access rights, available datasets, technical capabilities, organisational measures, and legal or contractual restrictions; (c) the proportionate due diligence to be carried out by the controller disclosing the data before relying on the conclusion that the recipient is not realistically able to identify the data subject; (d) the conditions under which recipients may be grouped by category where their relevant circumstances are materially equivalent; (e) the evidence to be retained by the controller and, where relevant, by the recipient, in order to demonstrate the basis for the assessment to the competent supervisory authority upon request; (f) the circumstances in which a material change in the recipient's means, access rights, available datasets, technical capabilities, organisational measures, or legal or contractual restrictions requires the assessment to be reviewed; and (g) the effect of such assessment on the qualification of the data for the controller, the recipient and any other person that is realistically able to identify the data subject. 3. The guidelines referred to in paragraph 1 shall take into account the state of the art; relevant case law; supervisory practice; risks of identification through attribution, singling out, linkage, or inference; and the use of technical and organisational measures reducing the risk of identification. 4. Those guidelines shall not alter the definition of personal data under Article 4, point (1), create a presumption that data resulting from pseudonymisation are not personal data, or reduce the level of protection of personal data under this Regulation.'

noyb's comment:

The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1) and Article 4(5).

#1310 Article 57 – paragraph 1 – point k (Article 3 – paragraph 1 – point 11)

Authored by

Regulation (EU) 2016/679
Article 57 – paragraph 1 – point k

Text proposed by the Commission

11. In Article 57(1) is amended as follows: (a) point (k) is deleted;

Amendment

deleted

noyb's comment:

Not all SAs have adopted DPIA guidelines yet.

#1319 Article 64 – paragraph 1 – point a (Article 3 – paragraph 1 – point 12)

Authored by

Regulation (EU) 2016/679
Article 64 – paragraph 1 – point a

Text proposed by the Commission

12. In Article 64(1), point (a) is deleted.

Amendment

deleted

noyb's comment:

Technical amendment to be consistent with amednments to Article 35(4);

#1323 Article 70 – paragraph 1 – point h (Article 3 – paragraph 1 – point 13)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point h

Text proposed by the Commission

13. In Article 70(1), point (h) is deleted.

Amendment

deleted

noyb's comment:

This amendment is probably related to a separate deletion of the Commission’s proposal regarding the establishment of black-lists regarding data breaches. On its own, this amendment has no significant impact.

#1340 Article 70 – paragraph 1 – point hca (new) (Article 3 – paragraph 1 – point 14)

Authored by

Regulation (EU) 2016/679 (GDPR)
Article 70 – paragraph 1 – point hca (new)

Text proposed by the Commission

Amendment

(hca) In Article 70, the following point is inserted: '(hca) issue guidelines on the pseudonymisation and anonymisation of personal data, including in the context of the development and operation of AI systems and models, and on the assessment of the residual risk of re-identification, taking into account the means reasonably likely to be used;'

noyb's comment:

This provision provides for further guidance by the EDPB and therefore for more claritiy.

#1342 Article 83 – Paragraph 5 – point ea (new) (Article 3 – paragraph 1 – point 14 a (new))

Authored by

Regulation (EU) 2016/679
Article 83 – Paragraph 5 – point ea (new)

Present text

(new)

Amendment

14a. In Article 83(5), the following point is added: "'(ea) infringements of the obligations relating to the verification, documentation and demonstration of the lawful origin, lawful processing and lawful making available of personal data collected from a third party, purchased, aggregated, enriched, sold or otherwise made available to third parties for commercial purposes, pursuant to Article 5(2a).'"

noyb's comment:

This amendment seems related to a separate amendment adding provisions regarding data traders to the principles. While this amendment has little effect (as violations against processing principles are already covered by Article 83(5) GDPR, it highlights the severity violations in the context of trade with personal data.

#1377 Article 88a – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679 (GDPR)
Article 88a – paragraph 2

Text proposed by the Commission

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).

Amendment

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6 and, where applicable, Article 9, including applicable obligations of professional secrecy to safeguard the objectives referred to in Article 23(1).

noyb's comment:

Minor clarification for the exception to the rule.

#1388 Article 88a – paragraph 3 – point ba (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point ba

Text proposed by the Commission

Amendment

(ba) In Article 88a, paragraph 3, the following point ba is inserted: '(ba) the prevention and detection of fraud, provided that the controller can demonstrate that the data are processed exclusively for that purpose, are not used for any other commercial purpose, and are not made available to third parties for purposes other than the prevention and detection of fraud.'

noyb's comment:

Further exception introduced. Similar to Recital 47 GDPR.

#1389 Article 88a – paragraph 3 – point c (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c

Text proposed by the Commission

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;

Amendment

deleted

noyb's comment:

Amendments leads to the result of the current legal framework.

#1392 Article 88a – paragraph 3 – point c (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c

Text proposed by the Commission

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;

Amendment

(c) creating aggregated, anonymised information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use, provided that such information is not further processed for another purpose;

noyb's comment:

Safeguards for the Commission proposal and yet a new exception compared to the current legal framework.

#1402 Article 88a – paragraph 3 – point d (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point d

Text proposed by the Commission

(d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

Amendment

(d) maintaining or restoring the integrity and security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

noyb's comment:

Broadens the exception proposed.

#1414 Article 88a – Paragraph 3a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – Paragraph 3a (new)

Text proposed by the Commission

Amendment

(3a) In Article 88a, the following paragraph 3a is added: '3a. Paragraph 3 shall not apply to behavioural or personalised advertising, profiling, customer segmentation, or the inference of health status or other special categories of personal data. Processing for those purposes shall require the data subject’s consent.

noyb's comment:

Limits the exceptions proposed by the Commission, but still accepts them.

#1416 Article 88a – Paragraph 3b (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/579
Article 88a – Paragraph 3b (new)

Text proposed by the Commission

Amendment

(3b) In Article 88a, the following paragraph 3b is added: '3b. The storing of information, or the gaining of access to information already stored, in the terminal equipment of a user or subscriber pursuant to this Article shall be without prejudice to Directive 2002/58/EC, which shall continue to apply in full. In particular, this Article shall not affect the confidentiality of communications and of the related traffic data, the protection of traffic and location data, the safeguards against unsolicited communications, and the possibility for Member States to adopt restrictive measures, as provided for in Articles 5, 6, 9, 13 and 15(1) of that Directive.'

Justification

The storing of, or access to, information in terminal equipment pursuant to Article 88a is without prejudice to Directive 2002/58/EC, which continues to apply in full, and in particular to the confidentiality of communications and of the related traffic data, the protection of traffic and location data, the safeguards against unsolicited communications, and the powers of Member States under Article 15(1). Without this clause, the transfer of the terminal regime to the GDPR could be read as an implicit repeal of the ePrivacy protections which survive it.

noyb's comment:

Would lead to two parallel legal frameworks, not well understandable. It seems the reaffirmation does however not add new rights.

#1417 Article 88a – Paragraph 3c (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/579
Article 88a – Paragraph 3c (new)

Text proposed by the Commission

Amendment

(3c) In Article 88a, the following paragraph 3c is added: '3c. In particular, information relating to other natural persons stored in the terminal equipment of a user or subscriber, such as contact details, constitutes personal data of those persons. Consent given by the user or subscriber to the storing of, or access to, such information shall not constitute consent by the natural persons to whom that information relates, nor a legal basis for any further processing of their personal data. Such information shall not be transmitted to third parties, nor used for purposes other than those strictly necessary for the service explicitly requested by the user or subscriber.'

Justification

Information relating to other natural persons stored in the terminal equipment of a user, such as contact details, constitutes personal data of those persons. Consent given by the user does not constitute consent by the persons to whom that information relates, nor a legal basis for any further processing of their data. Such information may not be transmitted to third parties nor used for purposes other than those strictly necessary for the service explicitly requested.

noyb's comment:

Privacy for contact details of third parties. In reality "mixed" data (e.g. pictures) is hard to seperate for a controller. When it comes to personal data this approach is already the law (users cannot "consent" for another person).

#1418 Article 88a – Paragraph 3d (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – Paragraph 3d (new)

Text proposed by the Commission

Amendment

(3d) In Article 88a, the following paragraph 3d is added: '3d. This Article shall be without prejudice to the right of data subjects to receive compensation for material or non-material damage resulting from the storing of information, or the gaining of access to information already stored, in their terminal equipment pursuant to this Article, and to the liability of controllers and processors for such processing.'

noyb's comment:

Restates Art 82 GDPR for the new Article 88a GDPR.

#1423 Article 88a – paragraph 4 – introductory sentence (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4 – introductory sentence

Text proposed by the Commission

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:

Amendment

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following principles shall apply:

noyb's comment:

Weakens the protection enviosioned by the Commission and provides less clarity for everyone involved.

#1425 Article 88a – paragraph 4 – point a (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4 – point a

Text proposed by the Commission

(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

Amendment

deleted

noyb's comment:

Removes clearer rules for user options.

#1430 Article 88a – paragraph 4 – point b (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4 – point b

Text proposed by the Commission

(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;

Amendment

deleted

noyb's comment:

Removes protection against deceptive practices, but also makes management of consent simpler.

#1433 Article 88a – paragraph 4 – point c (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c

Text proposed by the Commission

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.

Amendment

deleted

noyb's comment:

Removes protection against deceptive practices.

#1438 Article 88a – paragraph 4 – points a, b, c, d and da, db, dc (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4 – points a, b, c, d and da, db, dc (new)

Text proposed by the Commission

Amendment

In Article 88a, paragraph 4, points a, b, c, d are replaced by the following: '(a) Freedom: consent shall be given freely, the data subject having a genuine choice to refuse or withdraw it without detriment, and neither a contract, a service, nor access to its functionalities shall be made conditional on consent to storage or access that is not necessary for that service; (b) Specificity: consent shall be given separately for each specified, explicit and legitimate purpose, a distinct opt-in being provided for each; (c) Information: prior to giving consent, the data subject shall be informed, in clear and plain language, of at least the controller's identity, the purpose of each processing operation, the data used, and the right to withdraw consent at any time; (d) Unambiguity: consent shall be given by a statement or clear affirmative action, silence, inactivity, pre-ticked boxes or mere continued use of a service not constituting consent;' The following points are added: (da) Fair design: the interface used to give, refuse or withdraw consent shall be fair and neutral, and shall not give prominence to acceptance over refusal or otherwise impair the data subject's ability to decide freely; (db) Withdrawal: the data subject shall be able to withdraw consent at any time, as easily and through the same interface as it was given, free of charge and without degradation of the service; (dc) Demonstrability: the controller shall be able to demonstrate that valid consent was given, retaining no more information than necessary for that purpose.'

Justification

avoid hard-coded consent UX mandates sources guidelines EDPB 05/2020

noyb's comment:

Restates the general conditions of consent, but ads the fair design idea, which is more abstract and hence applicable to more situations than the Commission proposal.

#1440 Article 88a – paragraph 4a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4a (new)

Text proposed by the Commission

Amendment

(4a) In Article 88a, the following paragraph 4a is inserted: '4a. The Board shall encourage stakeholders to develop cross-device,, interoperable and ergonomic interfaces that address consent fatigue, while taking into account the economic balance of all the stakeholders concerned, by exploring possibilities such as: (a) enabling the data subject to refuse requests for consent in an easy and intelligible manner, through a single-click button or equivalent means; (b) ensuring that, where the data subject gives consent, the controller does not make a new request for consent for the same purpose during the period in which it can lawfully rely on that consent; (c) ensuring that, where the data subject declines a request for consent, the controller does not make a new request for consent for the same purpose for a reasonable period.'

noyb's comment:

Waters down the Commission proposal, does not provide clarity for anyone and shifts the regulation to the private sector ("stakeholders" shall develop a solution).

#1481 Article 88b – paragraph 1 – point ba (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 1 – point ba (new)

Text proposed by the Commission

Amendment

(ba) In Article 88b, paragraph 1, the following point ba is inserted: '(ba) The data subject shall retain the possibility to give, refuse or withdraw consent for a specific controller or service, and an automated indication shall not preclude the expression of such service-specific choices.'

noyb's comment:

Clarification that the signal is specific towards a controller.

#1486 Article 88b – paragraph 1a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 1a (new)

Text proposed by the Commission

Amendment

(1a) In Article 88b, the following paragraph 1a is inserted: '1a. Controllers such as providers of web browsers, websites, operating systems and applications shall make available the technical means for data subjects to express, through automated and machine-readable indications, their choice to give consent, to decline a request for consent or to exercise the right to object pursuant to Article 21(2). Such means shall be cross-devvice and interoperable, so that a signal expressed at one level, whether, terminal, operating system, browser, application or website, is recognised and given effect at the others, including between different applications and between different terminal devices used by the same data subject, and shall not constitute a single mandatory mechanism. nor be provided in a manner that concentrates the management of consent in a single system or entity. The technical means shall not be designed or operated so as to confer on the provider of a browser, operating system or terminal a preferential position in obtaining, refusing or managing consent.Controllers shall ensure that their online interfaces recognise and give effect to such indications, provided that the conditions for consent laid down in this Regulation are fulfilled.'

Justification

cross-device consent

noyb's comment:

Inclusion of additional rights and broadening the scope. Can add complexity for controllers, but also allow more modern consent management.

#1487 Article 88b – paragraph 1b (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 1b (new)

Text proposed by the Commission

Amendment

(1b) In Article 88b, the following paragraph 1b is inserted: '1b. Where technically feasible, data subjects shall be able to use automated and machine-readable means to indicate for which AI-related purposes their personal data may or may not be used. Those indications may distinguish between different purposes, including, for example, AI training, fine- tuning, evaluation, safety testing, generation of outputs, personalisation, advertising, profiling, biometric identification, scientific research, or other specified purposes. Controllers shall respect such indications where the relevant processing is based on consent or on Article 6(1)(f), unless Union or Member State law provides otherwise.'

noyb's comment:

Would make making choices easier, but seems to allow AI-related processing under legitimate interest and introduces an opening clause for national law, which could hinder its EU-wide application.

#1537 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 6

Text proposed by the Commission

(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.

Amendment

(6) Providers of web browsers, which are not SMEs, shall make available, without imposing them by default, the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. This paragraph is without prejudice to the possibility for controllers to obtain explicit consent by other means and shall be applied in accordance with the principle of technological neutrality.

noyb's comment:

Weakens the Commission proposal by allowing circumvention through other consent requests.

#1557 Article 88c – title (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – title

Text proposed by the Commission

Processing in the context of the development and operation of AI

Amendment

Processing in the context of the development and operation of innovative technologies

Justification

Replaces 'artificial intelligence' by 'innovative technologies'. The considerations governing the processing of personal data in the development and operation of AI are not specific to that technology: they apply to any innovative technology involving large-scale processing. Technological neutrality prevents the provision from becoming obsolete with the next technological cycle.

noyb's comment:

This proposal replaces AI with innovative technologies, which we believe were already in mind of the legislator when drafting the GDPR.

#1558 Article 88c – paragraph 2a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 2a (new)

Text proposed by the Commission

Amendment

In Article 88c, the following paragraph is added: '2a. The development and operation of an AI system or model may constitute, depending on the circumstances, one example of such a legitimate interest pursued by the controller or by a third party within the meaning of point (f) of Article 6(1), without prejudice to other present innovative technologies or future technological use cases. The assessment shall remain technologically neutral and depends on the purpose of the processing, including, as regards AI, the intended purpose within the meaning of Regulation (EU) 2024/1689.'

noyb's comment:

Repeats the Commission's proposal.

#1568 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 1

Text proposed by the Commission

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Amendment

Where the processing of personal data is necessary for the interests of the controller or a third party in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Justification

Article 88c should remain fully coherent not to create new sources of legal fragmentation within the Union. While the Commission’s objective of simplification is well founded, the current wording of Article 88c does not fully achieve that aim.First, Article 6 GDPR expressly refers to the legitimate interests of both the controller and a third party. Limiting Article 88c to the interests of the controller alone would therefore introduce an unnecessary restriction and would reduce legal certainty for the development and operation of AI systems. Second, the reference to an “unconditional right to object” is not aligned with the GDPR framework. The right to object is already comprehensively governed by Article 21 GDPR, which establishes the applicable conditions and limitations. Introducing an unconditional variant within Article 88c would deviate from that framework, create inconsistencies in interpretation and enforcement, and effectively render the legitimate interests ground unavailable in practice for the purposes covered by this provision.

noyb's comment:

The amendment rephrases the Commission's proposal.

#1569 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 1

Text proposed by the Commission

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Amendment

Processing of personal data that is necessary for the legitimate interests pursued by the controller or by a third party may be carried out on the basis of Article 6(1)(f), where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Such processing shall remain subject to an assessment carried out on a case-by-case basis. It shall not benefit from any presumption of lawfulness.

noyb's comment:

The amendment rephrases the Commission's proposal towards the current status under Article 6(1)(f).

#1580 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 2

Text proposed by the Commission

Amendment

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, , including measures to limit the derivation, inference, extraction or regurgitation of personal data by the system or model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data. Where the processing is carried out in the context of a high-risk AI system within the meaning of Regulation (EU) 2024/1689, or in the context of an AI regulatory sandbox or of testing in real world conditions under that Regulation, it shall comply with the conditions and safeguards laid down, respectively, in Articles 14, 59, 60 and 61 of that Regulation, which continue to apply.

Justification

The processing of personal data for the development and operation of AI systems and models must be accompanied by robust safeguards. This amendment specifies the organisational and technical measures required — data minimisation at the stage of source selection and of training and testing, protection of residually retained data against disclosure, enhanced transparency, and an unconditional right to object. It further clarifies that, where such processing is carried out in the context of a high-risk AI system, an AI regulatory sandbox or testing in real world conditions, it must comply with the conditions and safeguards laid down in Articles 14, 59, 60 and 61 of Regulation (EU) 2024/1689, which continue to apply. This ensures the coherence of the Union acquis and prevents the facilitation of data processing for AI purposes from derogating from the requirements applicable under the Artificial Intelligence Act.

noyb's comment:

The proposed amendment repeats existing AI Act obligations for high-risk AI systems/models.

#1585 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 2

Text proposed by the Commission

Amendment

Justification

noyb's comment:

The amendment pushes against an unconditional right to object.

#1711 Article 4 (Article 5 – paragraph 1 – point 1)

Authored by

Directive 2002/58/EC
Article 4

Text proposed by the Commission

1. Article 4 is deleted;

Amendment

deleted

Justification

Article 5(3) of Directive 2002/58/EC is maintained. The transfer of the terminal regime to Regulation (EU) 2016/679 must not have the effect of repealing the specific protection which the ePrivacy Directive affords to the integrity of terminal equipment, which applies irrespective of whether the information stored or accessed constitutes personal data. Maintaining Article 5(3) preserves the protection of legal persons and of information which is not personal data, which would otherwise be left without any protection.

noyb's comment:

Back to the current status.

#1715 Article 5 – paragraph 3 (Article 5 – paragraph 1 – point 2)

Authored by

Directive 2002/58/EC
Article 5 – paragraph 3

Text proposed by the Commission

2. After Article 5(3), the following subparagraph is added: ‘This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.’

Amendment

deleted

noyb's comment:

Back to the current version.