Amendments by Renew Europe Group | GDPR-OMNIBUS | Data Privacy in the EU Omnibus amendments

Text proposed by the Commission

(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵ . The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act. _________________ ¹⁵ Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (OJ L, 2025/327, 5.3.2025, ELI: http://data.europa.eu/eli/reg/2025/327/oj)

Amendment

(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same or higher level of data protection. The definition of personal data determines the fundamental threshold for the application of data protection rights and must remain completely objective. Personal data which have undergone pseudonymisation, and which could be attributed to a natural person by the use of additional information, must be considered as personal data, as data related to identified or identifiable natural person across all processing participants, independent of an individual controller's subjective intent, technical capabilities, or internal commercial restrictions.

noyb's comment:

The amendment improves the Commission's proposal and simplifies the interpretation of the GDPR by solidifying the intended objective definition of the current Article 4(1). This would also be simpler to administer in practice for business, authorities and courts.

#225 Recital 27 a (new)

Authored by

Text proposed by the Commission

Amendment

(27a) Trustworthy processing of data and legal clarity is necessary for economic growth and supporting innovation with socially beneficial outcomes. In order to achieve this, some clarifications are necessary particularly to enable wide use of anonymisation. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. However, personal data that cannot be directly or indirectly attributed to a natural person is not within the scope of Regulation (EU) 2016/679. Controllers should be allowed to process personal data for the sole purpose of anonymizing personal data. Such processing should typically be understood as a legitimate interest for a controller. At the same time, the protection of data subjects’ rights typically benefits from anonymization. Consequently, the balancing test should favour the processing of personal data for anonymization. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and foreseeable technological developments.

noyb's comment:

This amendment promotes anonymisation and allows controllers a derogation to anonymise data by claiming legitimate interest as a legal basis. This amendment can be beneficial for both controllers and data subjects.

#234 Recital 28

Authored by

Text proposed by the Commission

(28) In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as methodological and systematic approach applied while conducting the research in the specific area. Research and technology development should be conducted in academic, industry and other settings, including small and medium-sized undertakings, (Article 179(2) TFEU) and should be always of a of high quality and should adhere to the principles of principles of reliability, honesty, respect and accountability (verifiability).

Amendment

(28) In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as the purpose of the research, methodological and systematic approach and ethical standards applied while conducting the research. Moreover, adherence to the principles of principles of reliability, transparency, honesty, respect and accountability should be the conditions applied. Transparency should involve making research results publicly avaliable with due regard to legitimate limitations to access such as protection of intellectual property and trade secrets. Scientific research activites should be conducted autonomously and independently, free from undue pressure and contribute to the growth of society’s general knowledge and in the public interest. This does not exclude that the outcome of scientific research activities may also aim to further commercial or private interest, provided that the processing operations are functionally separated from commercial monetization, tracking, or profiling activities, contribute to verifiable public knowledge, strictly respect safeguards under Article 89(1), and are not used to circumvent general purpose limitation obligations for proprietary automated modeling. It is important that processing for scientific research activities prevent individuals from being subjected to harm or other infringements of their rights due to their participation in scientific research and respect, amongst others, self-determination and, to the extent necessary, the notion of consent to participate in research should be used as a safeguard and is to be considered distinctively from consent under Regulation (EU) 2016/679.

noyb's comment:

Important safeguards for data protection are added in case data would be usef for scientific research;

#255 Recital 30

Authored by

Text proposed by the Commission

(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.

Amendment

deleted

noyb's comment:

This amendment simply proposes to not alter recitals of the GDPR to include AI technologies.

#265 Recital 30 a (new)

Authored by

Text proposed by the Commission

Amendment

(30a) Processing of personal data may be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, including where such processing is carried out by a Member State in relation to military, defence or national security purposes, as referred to in Article 4(2) and 47 of the Treaty on European Union. In accordance with Article 4(2) TEU national security remains the sole responsibility of each Member State. This Regulation should therefore not affect the ability of Member States to carry out processing operations that are necessary for the safeguarding of such essential Member State functions.

noyb's comment:

Highlighting the limtiations of the GDPR. While this can be read as a mere restatement, it can have impact in business-to-governemnt processing situations, that can be covered by the GDPR so far.

#272 Recital 31

Authored by

Text proposed by the Commission

(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, providing an unconditional right to object to the processing of their personal data, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as currently.

#294 Recital 32 a (new)

Authored by

Text proposed by the Commission

Amendment

(32a) The training of AI systems and AI models can constitute a legitimate interest of the controller within the meaning of Article 6(1), point (e), where such training is necessary for the development of AI systems and AI models.

Justification

This amendment clarifies, at the level of general principle in Article 6(1) GDPR, that the training of AI systems and AI models can constitute a legitimate interest of the controller. Embedding this clarification directly in Article 6’s recital provides legal certainty for controllers developing AI systems across the full range of processing activities covered by the GDPR.

noyb's comment:

The amendment proposes to consider training of AI systems and AI models as a processing activity that can be conducted under legitimate interest across the board. This would be more limited thatn the COM proposal, but would still give AI training a clear basis in law, compared to the current GDPR.

#302 Recital 33

Authored by

Text proposed by the Commission

(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.

Amendment

(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order to reconcile the technical realities of massive, unstructured data ingestion during the initial model training with the high level of protection required for sensitive data, a narrowly tailored derogation from the prohibition under Article 9(1) should be provided not to disproportionately hinder the development of AI. This derogation must be interpreted strictly and limited exclusively to entirely inadvertent data collection during the initial development phase, rather than creating operational privilege. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to prevent the processing of those data, takes the appropriate measures during training phase and, once it identifies such data, effectively erase it prior to the completion of that phase, thereby preventing sensitive data from becoming structurally embedded within the AI systems or AI models. Considering the limitations of machine unlearning, where a model has already completed training and subsequent erasure is proven to be technically impossible, the controller should effectively protect such underlining data from being used to infer outputs, be reverse-engineered, lead to re-identification of data subjects or being disclosed or otherwise made available to third parties. Additionally, in such cases where erasal of data is technically unfeasible the controller should fully document this technical impossibility and notify competent supervisory authority while deploying robust mitigating measures to secure underlining data. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679. Moreover, this derogation does not encompass data provided by, or generated through the activity of, end users of online platforms or core platform services and should therefore be strictly excluded from this derogation across all stages of a AI system or AI model’s lifecycle, ensuring that these systems or models cannot exploit user interactions or prompts to bypass protection under Article 9 of Regulation (EU) 2016/679.

noyb's comment:

The proposed amendment is an improvement from a privacy perspective comared to the Commission's proposal, but still allows processing under Article 9 GDPR that was so far not possible.

#315 Recital 34

Authored by

Text proposed by the Commission

(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.

Amendment

(34) Processing of biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should be allowed only where the verification of the claimed identity of the data subject is strictly necessary and proportionate for a legitimate public interest or regulatory purpose persued by the controller, and suitable safeguards apply to ensure that both the biometric data and the operational means of processing remain under exclusive and continuous control of the data subject throughout enrolment, transmission, verification and erasure, enabling the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process. Biometric verification should not be deployed as a standard authentication mechanism where equally effective, less intrusive alternative verification methods are available. Controller should choose from equally effective means the least intrusive one. Storing encrypted templates on a controller's database does not satisfy the requirement of sole user control if decryption or comparison occurs within systems controlled technically or operationally by the controller.

noyb's comment:

The amendment improves the Commission's proposal by reducing its scope of application but remains a decrease of protection compared to the current Article 9. The new notion of legitimate public interest is inserted

#319 Recital 34

Authored by

Jan-Christoph Oetjen

Andreas Glück

Text proposed by the Commission

(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.

Amendment

(34) Processing of biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric recognition includes two distinct functions, namely the identification of a natural person or the verification of their claimed identity according to Article 3 (35) and (36) of Regulation (EU) 2024/1689. Derogating from the prohibition to process biometric data under Article 9(1) of Regulation (EU) 2016/679 should be allowed where the verification and identification of the data subject is necessary and proportionate for a purpose pursued by the controller. The derogation should only apply where the data subject is offered a non-biometric alternative and appropriate safeguards laid down under Union law are implemented to ensure fundamental rights of the data subject are adequately protected. It should be ensured that no photo or video is captured, even if not recorded and not processed, from individuals who do not consent to the facial recognition through appropriate measures. For example, where the biometric data are securely stored solely on the device of the data subject or are securely stored by the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is securely held solely by the data subject and subject to measures ensuring the overall security of processing, including during the enrolment phase of the data subject’s biometric data during the verification process. Such verification may in particular be required in the context of electronic identification systems and trust services under Union law. Other examples of appropriate safeguards are ensuring that end-to-end encryption is used when data are transmitted over a communication channel and providing data subjects with the possibility to securely rectify or delete their biometric data at any time.

noyb's comment:

The amendment almost goes back to a consent requirement, like under the current text, and includes an obligation to provide a less intrusive alternative.

#333 Recital 35

Authored by

Text proposed by the Commission

(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. By contrast, it should be clarified in Article 12 of the Regulation that the right of access, which is from the outset favourable to data subjects, should not be abused in the sense that the data subjects abuse them for purposes other than the protection of their data. For example, such an abuse of the right of access would arise where the data subject intends to cause the controller to refuse an access request, in order to subsequently demand the payment of compensation, potentially under the threat of bringing a claim for damages. Other examples of abuse include situations where data subjects make excessive use of the right of access with the only intent of causing damage or harm to the controller or when an individual makes a request, but at the same time offers to withdraw it in return for some form of benefit from the controller. Moreover, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive conduct of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abuse only to a reasonable level. In any event, while requesting access under Article 15 of Regulation (EU) 2016/679 the data subject should be as specific as possible. Overly broad and undifferentiated requests should also be regarded as excessive.

Amendment

(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. The right of access is a free-standing fundamental right that acts as an enabler of other rights, including journalistic oversight, litigation support, collective redress, and the verification of academic or workplace fairness. A request shall never be deemed excessive or abusive solely based on its broad, exploratory, or comprehensive nature, nor due to the subjective motivation of the individual. The data subject should not be required to provide a justification for the exercise of their rights, and they shall be presumed to act for reasonable purposes, unless the controller unequivocally demonstrates bad-faith abusive intent. Where a request is proven to be genuinely repetitive, the controller must give the individual a clear choice between paying a standardized administrative fee or having the request refused. Nevertheless, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive conduct of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abuse only to a reasonable level.

noyb's comment:

The amendment highlights the broad scope of the right to access.

#335 Recital 36

Authored by

Text proposed by the Commission

[...]

Amendment

deleted

noyb's comment:

Deletion of Commission's proposal regarding an additional exemption from the information requirement in Art 13.

#356 Recital 37

Authored by

Text proposed by the Commission

(37) Where the processing takes place for the purpose of scientific research and the provision of information to the data subject proves to be impossible or would involve a disproportionate effort it should not be necessary to provide the information provided for under Article 13 of this Regulation. The controller should make reasonable efforts to acquire contact details if they are readily available and acquisition would not require a disproportionate effort. The provision of the information would involve a disproportionate effort in particular where the controller at the time of collection of the personal data did not know or anticipate that it would process personal data for scientific research purposes at a later stage, in which case it may not have easily available contact details of the data subjects. In such situations the controller should inform data subjects indirectly, such as by making the information publicly available. The provision of such information should ensure that as many data subjects concerned as possible are reached. Relevant means to make the information publicly available should be determined depending on the context of the research project and the data subjects involved.

Amendment

(37) Where the processing takes place for the purpose of scientific research, provided it is not used for commercial product development, advertising, marketing, profiling or the training of data processing models for commercial deployment, transparency should remain effective. In such cases, if the provision of information to the data subject proves to be impossible or would involve a disproportionate effort, it should not be necessary to provide the information provided for under Article 13 of this Regulation. The controller should make reasonable efforts to acquire contact details if they are readily available and acquisition would not require a disproportionate effort, while public information should not replace direct information where contact details are available or can be reasonably obtained The provision of the information would involve a disproportionate effort in particular where the controller at the time of collection of the personal data did not know or anticipate that it would process personal data for scientific research purposes at a later stage, in which case it may not have easily available contact details of the data subjects. In such situations, the controller should document its reliance on this exception, make such documentation available to the supervisory authority upon request, and should inform data subjects indirectly, such as by making the information publicly available. The provision of such information should ensure that as many data subjects concerned as possible are reached, and where information is made publicly available, such public information should be prominent, accessible and sufficiently specific to enable data subjects to understand the processing and exercise their rights. Relevant means to make the information publicly available should be determined depending on the context of the research project and the data subjects involved.

noyb's comment:

Even though the proposal introduces important safeguards to the Commission's proposal, the level of privacy is still below the old version of Article 13 while the proposal provides for less simplification than the Commission's proposal.

#364 Recital 38

Authored by

Text proposed by the Commission

(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.

Amendment

(38) Automated procedures can significantly benefit the digital economy by streamlining routine operations such as Know-Your-Customer (KYC) verifications or fraud preventions. However, when deployed for a higher risk evaluations producing legal or similarly significant effects, such as automated hiring, the termination of contracts or online accounts, profiling or creditworthiness decision, they entail heightened risks to individual rights. Article 22 of Regulation (EU) 2016/679 provides that the data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should therefore be clarified that decisions based solely on automated processing are generally prohibited, and that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, automated processing is permitted only if no other equally effective and less privacy-intrusive means are available to fulfil the core objective of the contractual service explicitly requested by the data subject. Moreover, to prevent a gap in legal protection, the concept of a decision should extend to automated processing or profiling operations that generate an assessment or value upon which a subsequent controller strongly relies as a determining factor in its decision-making. When several equally effective automated processing solutions exist, the controller should use the least intrusive one, guaranteeing in all cases the data subject's right to obtain human intervention, express their point of view, and contest the automated outcome, while utilizing appropriate procedures to minimize error risks.

noyb's comment:

Generally, a privacy friendly proposal that highlights the dangers of ADM and apparently tries to strengthen the position of the data subject in case of ADM. However, when codifying the SCHUFA II case law, the phrase “strongly relies as a determining factor” is too restrictive. Therefore, the proposal is just privacy-neutral.

#385 Recital 39

Authored by

Text proposed by the Commission

(39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches.

Amendment

(39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should establish and make public a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches.

noyb's comment:

This proposal maintains the notion that the risk threshold for the data breach notification to the authority should be aligned with the threshold for the obligation to communicate the data breach to the data subject. At the same time, the proposal amends “high risk” to “risk” which is inconsistent. It is therefore rather unclear what the goal of this proposal is in this regard – reducing any simplicity provided in the Commission’s proposal.

#391 Recital 40

Authored by

Text proposed by the Commission

(40) Article 35 of that Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. The lists of processing operations should be prepared by the Board and adopted by the Commission as an implementing act. In order to facilitate compliance by controllers, the Board should also prepare a common template and a common methodology for conducting data protection impact assessments, to be adopted by the Commission as an implementing act. The Commission should take due account of the proposals prepared by the Board and review them, as necessary, prior to adoption. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary.

Amendment

(40) Article 35 of that Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. The lists of processing operations should be established and made public by the Board. In order to facilitate compliance by controllers, the Board should also prepare a common template and a common methodology for conducting data protection impact assessments. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary. The Commission may adopt, by means of an implementing act, the common template as established by the Board, as well as its updates where necessary.

noyb's comment:

This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB.

#427 Recital 44 – paragraph 1

Authored by

Text proposed by the Commission

The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment and the subsequent processing of such data should be regulated under a single legal framework, namely Regulation (EU) 2016/679, where the subscriber of the electronic communications service or the user of the terminal equipment is a natural person. The amendments presented in this Regulation continue to offer the highest levels of protection for personal data, while simplifying the experiences of data subjects in exerting their rights and expressing their choices online. The amendments concern in particular storage of information in that equipment, accessing or otherwise collecting information from that equipment that entails the processing of personal data through cookies or similar technologies to gain information from the terminal equipment. The relevant rules should also apply regardless of whether the terminal equipment is owned by the natural person or by another legal or natural person.

Amendment

The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment and any subsequent processing constitutes a highly intrusive interference with the fundamental rights to confidentiality of communications and device integrity, and should be therefore subject to strict protections, where the subscriber of the electronic communications service or the user of the terminal equipment is a data subject. The amendments presented in this Regulation continue to offer the highest levels of protection for personal data, while simplifying the experiences of data subjects in exerting their rights and expressing their choices online. The amendments concern in particular storage of information in that equipment, accessing or otherwise collecting information from that equipment that entails the processing of personal data through cookies or similar technologies to gain information from the terminal equipment. The relevant rules should also apply regardless of whether the terminal equipment is owned by the data subject or by another legal or natural person.

noyb's comment:

Highlights the importance of interferences through tracking.

#430 Recital 44 – paragraph 2

Authored by

Text proposed by the Commission

The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment should continue to be allowed only on the basis of consent. Similar to the approach in Directive 2002/58/EC, this requirement should not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, when that is based on Union or Member State law within the meaning of Article 6 of Regulation (EU) 2016/679 and if it fulfils all conditions of lawfulness laid down in that provision, and is done for the objectives laid down in Article 23(1) of Regulation (EU) 2016/679.

Amendment

The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment should continue to be allowed only on the basis of consent. Similar to the approach in Directive 2002/58/EC, this requirement should not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, when that is based on Union or Member State law within the meaning of Article 6 of Regulation (EU) 2016/679 and if it fulfils all conditions of lawfulness laid down in that provision, and is done for the objectives laid down in Article 23(1) of Regulation (EU) 2016/679, provided that any such measure is necessary and proportionate and does not require the general identification of users, nor the weakening of anonymity, encryption or other protective tools on which users, including journalists, activists and other persons at risk, rely.

noyb's comment:

Overall partly goes down the avenue of the Commissioni proposal, which brings a lot of legal uncertainty.

#433 Recital 44 – paragraph 2

Authored by

Text proposed by the Commission

The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment should continue to be allowed only on the basis of consent. Similar to the approach in Directive 2002/58/EC, this requirement should not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, when that is based on Union or Member State law within the meaning of Article 6 of Regulation (EU) 2016/679 and if it fulfils all conditions of lawfulness laid down in that provision, and is done for the objectives laid down in Article 23(1) of Regulation (EU) 2016/679.

Amendment

The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment should continue to be allowed only on the basis of consent. Similar to the approach in Directive 2002/58/EC, this requirement should not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject, when that is based on Union or Member State law within the meaning of, and subject to the conditions of, Article 6 (3) of Regulation (EU) 2016/679 and if it fulfils all conditions of lawfulness laid down in that provision, and is done for the objectives laid down in Article 23(1) of Regulation (EU) 2016/679.

noyb's comment:

Goes along with the Commission divide that wants to regulate cookies with and without personal data differently. Less legal certainty.

#440 Recital 44 – paragraph 3

Authored by

Text proposed by the Commission

With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. The controller, such as a media service provider, may mandate a processor, such as a market research company, to carry out the processing on its behalf.

Amendment

With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is strictly necessary for those specific purposes, this Regulation should therefore provide that the processing is lawful. These narrow exceptions should strictly apply to technical communications transmission, the execution of explicit services requested by the data subject, necessary security operations, or audience measurement metrics for media service providers, or third-party providers of audience measurement for media services providers, provided it follows conditions for low processing risks, namely for statistical counting and is not utilised for profiling of data subject and does not involve core platfroms services as defined in Regulation (EU) 2022/1925. Following these conditions, the controller, such as a media service provider, may therefore mandate a processor, such as a market research company, to carry out the processing on its behalf.

noyb's comment:

Relies on further exceptions to the current legal framework, but tries to limit the Commission proposal.

#443 Recital 44 – paragraph 3

Authored by

Text proposed by the Commission

With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. The controller, such as a media service provider, may mandate a processor, such as a market research company, to carry out the processing on its behalf.

Amendment

With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. Those purposes should be interpreted narrowly and should not serve as a basis for tracking, profiling or the large-scale monitoring of the online activity of data subjects. The controller, such as a media service provider, may mandate a processor, such as a market research company, to carry out the processing on its behalf.

noyb's comment:

Relies on further exceptions to the current legal framework, even if they should be interpreted "narrowly".

#448 Recital 44 – paragraph 4

Authored by

Text proposed by the Commission

For the subsequent processing of personal data for other purpose than those defined in the limitative list, Article 6 and, where relevant, Article 9 of Regulation (EU) 2016/679 should be applied. It is the responsibility of the controller in the light of the principle of accountability to choose the appropriate legal basis for the intended processing. In order to be able to rely on legitimate interest under Article 6(1), point f, of Regulation (EU) 2016/679 as a ground for the subsequent processing of personal data, the controller must show that it pursues the controller’s or third parties’ legitimate interest, the processing is necessary in order to achieve the purpose of that legitimate interest, and the interests or fundamental rights of the data subject do not override the interests pursued by the controller. In this context, controllers should take outmost account of the following elements: whether the data subject is a child; the reasonable expectations of data subject; the impact on the individual either because of the scale of data processed or the sensitivity of the data processed; the scale of the processing at issue in the sense that the processing cannot be particularly extensive either because of their amount or the range of categories of data; the processing should be based on data limited to what is necessary and cannot be based on monitoring of large parts of the online activity of the data subjects; and other relevant factors as appropriate. The processing should not give rise to the continuous monitoring of the data subject’s private life.

Amendment

For the subsequent processing of personal data for other purpose than those defined in the limitative list, such as development and operating of artificial intelligence models, controllers may seek to rely on legitimate interest under Article 6 (1), point (f) while Article 9 of Regulation (EU) 2016/679 should nevertheless be applied. However, to ensure that such processing does not override the fundamental rights and freedoms of data subjects, controllers must implement mandatory checklist of technical and organisational standards. These must include providing data subjects with an absolute right to object after being fully informed, ensuring state-of-the-art technics for data anonymisation, the executing rigorous technical abstration during the model training phase to make data disclosure extremely unlikely. To reduce individual administrative burdens, Member States should enable data subjects to administer their absolute right to object through a centralised public body. To ease complience and ensure uniformed approach, minimum standards for these techniques should be technically defined through standardisation. It is the responsibility of the controller in the light of the principle of accountability to choose the appropriate legal basis for the intended processing. In order to be able to rely on legitimate interest under Article 6(1), point f, of Regulation (EU) 2016/679 as a ground for the subsequent processing of personal data, the controller must show that it pursues the controller’s or third parties’ legitimate interest, the processing is necessary in order to achieve the purpose of that legitimate interest, and the interests or fundamental rights of the data subject do not override the interests pursued by the controller. In this context, controllers should take utmost account of the following elements: whether the data subject is a child; the reasonable expectations of the data subject; the impact on the individual either because of the scale of data processed or the sensitivity of the data processed; the scale of the processing at issue in the sense that the processing cannot be particularly extensive either because of their amount or the range of categories of data; the processing should be based on data limited to what is necessary and cannot be based on monitoring of large parts of the online activity of the data subjects; and other relevant factors as appropriate. The processing should not give rise to the continuous monitoring of the data subject’s private life.

noyb's comment:

Relies on further exceptions to the current legal framework. Will not simplify the current legal framework.

#451 Recital 44 – paragraph 4

Authored by

Text proposed by the Commission

For the subsequent processing of personal data for other purpose than those defined in the limitative list, Article 6 and, where relevant, Article 9 of Regulation (EU) 2016/679 should be applied. It is the responsibility of the controller in the light of the principle of accountability to choose the appropriate legal basis for the intended processing. In order to be able to rely on legitimate interest under Article 6(1), point f, of Regulation (EU) 2016/679 as a ground for the subsequent processing of personal data, the controller must show that it pursues the controller’s or third parties’ legitimate interest, the processing is necessary in order to achieve the purpose of that legitimate interest, and the interests or fundamental rights of the data subject do not override the interests pursued by the controller. In this context, controllers should take outmost account of the following elements: whether the data subject is a child; the reasonable expectations of data subject; the impact on the individual either because of the scale of data processed or the sensitivity of the data processed; the scale of the processing at issue in the sense that the processing cannot be particularly extensive either because of their amount or the range of categories of data; the processing should be based on data limited to what is necessary and cannot be based on monitoring of large parts of the online activity of the data subjects; and other relevant factors as appropriate. The processing should not give rise to the continuous monitoring of the data subject’s private life.

Amendment

For the subsequent processing of personal data for other purpose than those defined in the limitative list, Article 6 and, where relevant, Article 9 of Regulation (EU) 2016/679 should be applied. It is the responsibility of the controller in the light of the principle of accountability to choose the appropriate legal basis for the intended processing. In order to be able to rely on legitimate interest under Article 6(1), point f, of Regulation (EU) 2016/679 as a ground for the subsequent processing of personal data, the controller must show that it pursues the controller’s or third parties’ legitimate interest, the processing is necessary in order to achieve the purpose of that legitimate interest, and the interests or fundamental rights of the data subject do not override the interests pursued by the controller. In this context, controllers should take outmost account of the following elements: whether the data subject is a child; the reasonable expectations of data subject; the impact on the individual either because of the scale of data processed or the sensitivity of the data processed; the scale of the processing at issue in the sense that the processing cannot be particularly extensive either because of their amount or the range of categories of data; the processing should be based on data limited to what is necessary and cannot be based on monitoring of large parts of the online activity of the data subjects; and other relevant factors as appropriate. The processing should not give rise to the continuous monitoring of the data subject’s private life. Where age assurance is necessary, it should rely on privacy-preserving and data-minimising techniques, and should not undermine the anonymity or confidentiality of communications.

noyb's comment:

Adds information on age assurance, but otherwise relies on the permissive Commission proposal.

#458 Recital 45

Authored by

Text proposed by the Commission

(45) Data subjects that have refused a request for consent are often confronted with a new request to give consent each time they visit the same controller’s online service again. This may have detrimental effects to the data subjects which may consent just in order to avoid repeating requests. The controller should therefore be obliged to respect the data subject’s choices to refuse a request for consent for at least a certain period.

Amendment

(45) Data subjects that have refused a request for consent are often confronted with a new request to give consent each time they visit the same controller’s online service again. This may have detrimental effects to the data subjects which may consent just in order to avoid repeating requests. To enable genuine freedom of choice, the controller should therefore be obliged to respect the data subject’s choices to refuse, withdraw, or receive relavent information to make informed decision regarding a request for consent for at least one year, prevening continuous requests, including via pop-up windows on online interface. Moreover, data subject’s freedom to express a refusal or withdrawal of consent must be as effortless and instantaneous as granting it. Therefore, web browsers and operating systems should enable user-friendly, straightforward and prominently displayed single-click button to refuse or withdraw consent directly alongside any option to accept. Furthermore, users should never be put in the situation of surrendering their data by providers of services denying them access to a service or any functionality of that service, unless it is strictly necessary for the functioning of that service. It is also necesarry to protect users from unsolicited invasive stealth tracking methods. Therefore, online choice architectures should be designed neutrally, and the processing of indentifiers beyond what is strictly to remember a privacy choice when consent is refused or withdrawn should not be permitted. Furthermore, in order to guarantee the validity of user intent, consent obtained through manipulative designs or dark patters that distors free choice should be considered legally invalid.

noyb's comment:

Improves user choices clearly. Simplification of the transaction is overall improved.

#464 Recital 46

Authored by

Text proposed by the Commission

(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser or in the EU Digital Identity Wallet as set out by Regulation (EU) 914/2014, or any other adequate means. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, media service providers should not be obliged to respect the machine-readable indications of data subject’s choices. The obligation for providers of web browsers to provide the technical means for data subjects to make choices with respect to the processing should not undermine the possibility for media service providers to request consent by data subjects.

Amendment

(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser or operating systems, or any other adequate means. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. To simplify interactions across the digital ecosystem and prevent consent fatique, data subjects should have the posibility to configure their general privacy pereferences globally and centrally within the settings of their web browser or operating systems. At the same time, to perserve a high degree of choice granularity and foster a competative market for innovative privacy-enhancing services within the Union, data subjects should have the option to delegate the dynamic management of these preferences to independent third-party software applications, browser extentions, or automated consent agents acting on their behalf. Providers of web browsers and operating systems should ensure their underlining technical infrastructure natively supports such tools, and should present users upon first use with a clear prompt to select their preferred configuration. Furthermore, data subjects should not face technical barriers or artificial degradation of service functionality when choosing to safeguard their privacy. Providers of web browsers and operating systems, as well as online service providers, should therefore not be allowed from restricting, denying or limiting access to their interfaces or core features merely because data subjects use privacy-enhancing technologies, such as Virtual Private Networks, or broweser extentions, provided that these tools comply with technical specificiations established by harmonised standards. To allow further choices for users and ensure granuality, and in light of the importance of independent journalism in a democratic society and in order not to undermine their economic basis and the need to protect its economic sustainability, data subjects should have the practical options to import pre-configured recommemded choices, which may come, for example, as whilelists to allow interaction with trusted online interfaces, such as editorially independent media service providers, which would therefore be granted a specfic exception. In this way, an exception for media service provided would not only ensure that automated signals do not inadvertenly cut off revenue for public interest media, but would also spare these providers from having to deploy standalone pop-up windows to obtain consent. Therefore, media service providers providing news and current affairs content that comply with the editorial independence standards of Regulation (EU) 2024/1083 should have the right to have their online interfaces included in recommended whitelists maintained by web browsers or operating systems, or third-party agents. To ensure user autonomy remains paramount, web browsers and operating systems should explicitly and neutrally prompt the data subject upon first use to allow this specific media exception. Finally, to maintain the integrity of this choice ecosystem, providers of web browsers and operating systems should be acting strictly as neutral technical conduits, while those acting as a core service providers should be prohibited from processing, analyzing, or capitalising on the privacy choices expressed by the user for any secondary purpose other than transmitting the signal.

noyb's comment:

Overall clear additions for privacy signals. The mention of VPNs and browser extensions in general, however, is unrelated to automated user choices and should be deleted.

#483 Recital 47

Authored by

Text proposed by the Commission

(47) Directive 2002/58/EC on privacy and electronic communications ‘ePrivacy Directive’), last revised in 2009, provides a framework for the protection of the right to privacy, including the confidentiality of communications. It also specifies Regulation (EU) 2016/679 in relation to processing of personal data in the context of electronic communication services. It protects the privacy and the integrity of user’s or subscriber’s terminal equipment used for such communications. The current provision of Article 5(3) of Directive 2002/58/EC should remain applicable insofar as the subscriber or user is not a natural person, and the information stored or accessed does not constitute or lead to the processing of personal data.

Amendment

(47) Directive 2002/58/EC on privacy and electronic communications ‘ePrivacy Directive’), last revised in 2009, provides a framework for the protection of the right to privacy, including the confidentiality of communications. It also specifies Regulation (EU) 2016/679 in relation to processing of personal data in the context of electronic communication services. It protects the privacy and the integrity of user’s or subscriber’s terminal equipment used for such communications.

noyb's comment:

Unclear if change means that the ePrivacy Directive remains applicable as it is or some other change is intended.

#931 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)

Authored by

Regulation (EU) 2016/679
Article 4 – point 1 – second part

Text proposed by the Commission

(a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as currently.

#936 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)

Authored by

Regulation (EU) 2016/679
Article 4 – point 1 – second part

Text proposed by the Commission

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as currently.

#942 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)

Authored by

Regulation (EU) 2016/679
Article 4 – point 1 – second part

Text proposed by the Commission

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

Amendment

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. The parameters of a trained AI model do not constitute personal data where, taking into account the means reasonably likely to be used, a natural person whose personal data was processed during training cannot be identified from the model.

Justification

In line with the case law of the Court of Justice of the European Union (ECLI:EU:C:2025:645), the training of an AI model should not be considered as processing of personal data solely on the ground that its output may contain references to personal data. Such an output constitutes the statistically most probable result generated by the model, rather than the retrieval or reproduction of personal data as such.

noyb's comment:

The amendment includes more derogations than the Commission's proposal.

#951 Article 4 – point 33 (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 33

Text proposed by the Commission

(33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply;

Amendment

deleted

#963 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 38

Text proposed by the Commission

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.

Amendment

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. The development, training, testing and validation of new technologies, such as AI systems, AI models and AI agents may be topics of scientific research where it meets the conditions of this point.

Justification

Clarifying that the development of new technologies, such as the training of an LLM, may also be considered as scientific research.

noyb's comment:

Suggests that AI trainging is "research", which goes beyond current understanding.

#967 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 38

Text proposed by the Commission

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.

Amendment

(38) “scientific research” means any research conducted in autonomous and independent manner, with the aim of contributing to the growth of society´s general knowledge and wellbeing, adhere to recognised ethical standards for scientific research in the public interest, with respect to human autonomy and producing verifiable and transparent results.

noyb's comment:

Improved definition, more narrow scope

#977 Article 4 – point 38a (new) (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 38a (new)

Text proposed by the Commission

Amendment

(38a) ‘anonymisation’ is the process of rendering personal data anonymous, which means a processing operation that removes any relationship between data and an identified or identifiable natural person (‘data subject’); To determine whether a natural person is identifiable, account should be taken of all the means that can be used now or in the foreseeable future, such as singling out, either by the controller or by any other person to identify the natural person directly or indirectly.

noyb's comment:

Improved definition of anoymization. Also giving more legal certainty for controllers.

#991 Article 5 – paragraph 1 – point b (Article 3 – paragraph 1 – point 2)

Authored by

Regulation (EU) 2016/679
Article 5 – paragraph 1 – point b

Text proposed by the Commission

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);

Amendment

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or for the development, training, testing, validation or use of new technical solutions based on aggregated data, including AI systems and AI models, subject to the safeguards in Article 88c and without prejudice to Article 9 shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);

Justification

Data collected for one purpose can be reused for research, statistics, archiving, or for training, testing, or using AI systems on data from which individuals are not identifiable, and this reuse is deemed compatible with the original purpose (so no separate legal basis is needed under Art. 6(4)), provided the Article 88c safeguards apply and it doesn't override Article 9 (special category data protections).

noyb's comment:

This amendment proposes a derogation from the purpose limitation principle for AI, which is not in line with Article 8 and 52 of the CFREU.

#998 Article 6 – paragraph 4 – point d (Article 3 – paragraph 1 – point 2 – point i (new))

Authored by

Regulation (EU) 2016/679
Article 6 – paragraph 4 – point d

Text proposed by the Commission

Amendment

i) In Article 6, paragraph 4, point d is replaced by the following: '(d) the possible consequences of the intended further processing for data subject, in particular where the data subject is a child;'

noyb's comment:

The proposed text includes particular attention for processing in relation to children, however this is (often) read as a factor to argue that the protection is not to be afforedt to adults.

#999 Article 6 – paragraph 1 – subparagraph 3 (Article 3 – paragraph 1 – point 2 – point ii (new))

Authored by

Regulation (EU) 2016/679
Article 6 – paragraph 1 – subparagraph 3

Text proposed by the Commission

Amendment

ii) In Article 6, paragraph 1, the following subparagraph is added: 'The processing of a child’s personal data for advertising purposes and for the creation of personality and user profiles is not permitted.'

noyb's comment:

The proposed amendment is a new clear prohibition of certain processings in relation to children.

#1005 Article 6 – paragraph 1 – point e (Article 3 – paragraph 1 – point 2 a (new))

Authored by

Regulation (EU) 2016/679
Article 6 – paragraph 1 – point e

Present text

Article 6, paragraph 1(e)

Amendment

2a. In Article 6, paragraph 1, point e, the following sentence is added: "This is the case, when processing is necessary for the performance of a task carried out by a Member State related to national security (Article 4(2) TEU)."

Justification

It should be made possible for Member State authorities to make use of the necessary personal and non-personal (mixed) datasets if it is used for national security purposes. This amendment is however, not intended to narrow the existing exclusion or invite GDPR oversight of national security processing.

#1011 Article 6 – paragraph 1 – point e – second sentence (Article 3 – paragraph 1 – point 2 b (new))

Authored by

Regulation (EU) 2016/679
Article 6 – paragraph 1 – point e – second sentence

Present text

(e)processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

Amendment

2b. Article 6 paragraph 1, point e, the following point is added: "This is the case, when processing is necessary for the performance of a task carried out by a Member State related to military and defence purposes as mentioned in Article 42 TEU."

Justification

It should be made possible for Member State authorities to make use of the necessary personal and non-personal (mixed) datasets if it is used for military and defence purposes.

noyb's comment:

The amendment includes a derogation in relation to Article 6(1)(e) which is not foreseen in the current regime. Could allow for secondary use of commercial data for military purposes.

#1026 Article 9– paragraph 2 – point k (Article 3 – paragraph 1 – point 3 – point a)

Authored by

Regulation (EU) 2016/679
Article 9– paragraph 2 – point k

Text proposed by the Commission

(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.

Amendment

(k) strictly incidental and residual processing in the context of the development of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.

noyb's comment:

The amendment does not include any new substantive element (if read with the proposed Article 9(5) GDPR) and maintains the additional exception by the Commission.

#1033 Article 9 – paragraph 2 – point l (Article 3 – paragraph 1 – point 3 – point a)

Authored by

Jan-Christoph Oetjen

Andreas Glück

Regulation (EU) 2016/679 (GDPR)
Article 9 – paragraph 2 – point l

Text proposed by the Commission

(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.

Amendment

(l) processing of biometric data is necessary for the purpose of verifying the identity or identifying a data subject, provided that biometric data is optional, the data subject has access to a non-biometric alternative of comparable effectiveness and that no photo or video is captured from individuals who do not consent to the facial recognition, and that appropriate safeguards laid down under Union law are applied to ensure the protection of fundamental rights of the data subject.

noyb's comment:

The amendment improves the Commission's proposal to a point where data subjects are almost as protected as in the current regime, by having other choices.

#1035 Article 9 – paragraph 2 – point l (Article 3 – paragraph 1 – point 3 – point a)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 2 – point l

Text proposed by the Commission

(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.

Amendment

(l) processing of biometric data is strictly necessary and proportionate for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject and subject to appropriate safeguards to protect the fundamental rights and the interests of the data subject, as laid down in Union law or Member State law, in accordance with paragraph 4 of this article.

noyb's comment:

The amendment improves the Commission's proposal, but still allows additional processing.

#1051 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 5

Text proposed by the Commission

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

Amendment

5. For processing referred to in point (k) of paragraph 2, strict organisational and technical measures shall be implemented to prevent the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation, the controller shall erase such data without undue delay prior to the completion of the training phase of the AI system or AI model. If erasure of those data from an already trained AI system or AI model proves to be technically impossible, the controller shall fully document the technological impossibility, notify the competent supervisory authority, and without undue delay, and in any event, effectively protect such data by applying state-of-the-art filtering or aligment techniques to guarantee such data cannot be further processed, used to produce outputs, re-identified, disclosed or otherwise made available to third parties. Processing referred to in point k of paragraph 2 should exlude the processing of special categories of personal data originating from data provided by, or generated through, the activity of end users on online platforms or core platfrom services as defined in Regulation (EU) 2022/1925, irrespective of whether such processing occurs during the development, training, or operational phase of any AI system or AI model.

noyb's comment:

Reiterates a process that would typically already apply under the current text of the GDPR. Some matters like the "technical impossibility" are currently not a defense for controllers. Specifying this further may be useful, but the overall protection would be similar to the GDPR, but also add exceptions.

#1076 Article 12 – paragraph 5 (Article 3 – paragraph 1 – point 4)

Authored by

Regulation (EU) 2016/679
Article 12 – paragraph 5

Text proposed by the Commission

4. In Article 12, paragraph 5 is replaced by the following: ‘5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.’

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as currently.

#1100 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)

Authored by

Regulation (EU) 2016/679
Article 13 – paragraph 4

Text proposed by the Commission

5. In Article 13, paragraph 4 is replaced by the following: ‘4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.’

Amendment

deleted

noyb's comment:

Deletion of Commission's proposal.

#1122 Article 13 – paragraph 5 (Article 3 – paragraph 1 – point 6)

Authored by

Regulation (EU) 2016/679
Article 13 – paragraph 5

Text proposed by the Commission

5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.

Amendment

5. When the further processing takes place for scientific research purposes, provided it is not used for commercial product development, advertising, marketing, profiling or the training of data processing models for commercial deployment, and where the controller does not possess or cannot reasonably obtain the contact details of the data subject without disproportionate effort, and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall document the reliance of this exception, make such documentation available to the supervisory authority upon request, and take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including annoucing the information publicy or informing the data subject without undue delay as soon as the conditions of this paragraph have ceased to exist.

noyb's comment:

This proposal increases the level of data protection compared to the Commission's proposal since it adds important requirements. However, compared to the current version, it still adds the exemption from the information obligation for some scientific processing. It also adds documentation requirements. It may violate the purpose limitation and fairness principle in Article 8(2) of the Charter.

#1131 Article 21 – paragraph 1 (Article 3 – paragraph 1 – point 6 a (new))

Authored by

Regulation (EU) 2016/679
Article 21 – paragraph 1

Text proposed by the Commission

Amendment

6a. In Article 21, paragraph 1 is replaced by the following: '1. The data subject shall have the right to object, on grounds relating to his or her particular situation, notably where the data subject is a child, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.'

noyb's comment:

The only introduction is “notably where the data subject is a child”. While it is not completely certain, it could be assumed that this means that the fact that the data subject is a child in itself means that there are grounds relating to their particular situation allowing for an objection. This would increase the level of privacy for children since they don’t have to provide further proof regarding their situation. Since the wording is unclear, this cannot be considered to provide for clear simplification.

#1138 Article 22 (Article 3 – paragraph 1 – point 7 – introductory part)

Authored by

Regulation (EU) 2016/679
Article 22

Text proposed by the Commission

7. In Article 22, paragraphs 1 and 2 are replaced by the following:

Amendment

7. Article 22 is replaced by the following:

#1144 Article 22 – paragraph 1 (Article 3 – paragraph 1 – point 7)

Authored by

Regulation (EU) 2016/679
Article 22 – paragraph 1

Text proposed by the Commission

1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision:

Amendment

1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effect concerning them or similarly significantly affects them, unless such processing:

noyb's comment:

Reversion of Commission's proposal.

#1147 Article 22 – paragraph 2 – point a (Article 3 – paragraph 1 – point 7)

Authored by

Regulation (EU) 2016/679
Article 22 – paragraph 2 – point a

Text proposed by the Commission

(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means;

Amendment

(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller

noyb's comment:

Deletion of Commission's amendment.

#1152 Article 22 – paragraph 1 – point c (Article 3 – paragraph 1 – point 7)

Authored by

Regulation (EU) 2016/679
Article 22 – paragraph 1 – point c

Text proposed by the Commission

(c) is based on the data subject's explicit consent.

Amendment

(c) is based on the data subject's explicit consent, provided that the data subject is not a child.

noyb's comment:

Limitation of the consent option for children - which is however already regulated (consent only via parents) in Article 8 GDPR. Uncelar how the age will be determined by the controller.

#1155 Article 22 – paragraph 1a (new) (Article 3 – paragraph 1 – point 7)

Authored by

Regulation (EU) 2016/679
Article 22 – paragraph 1a (new)

Text proposed by the Commission

Amendment

1a. In Article 22, the following paragraph is inserted: '1a. In the cases referred to in points (a), (b) and (c) of paragraph 1, the data controller shall implement suitable technical and organisational measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain genuine human intervention of the part of the controller, to express his or her point of view and to contest the decision taken, as referred to in paragraph 1. The human reviewer designated to perform such intervention shall possess the necessary competence, knowledge to understand all relevant underlining data, and shall be empowered to modify or override the decision without delay.'

noyb's comment:

Positive codification and clarification.

#1158 Article 22 – paragraph 4 (Article 3 – paragraph 1 – point 7)

Authored by

Regulation (EU) 2016/679
Article 22 – paragraph 4

Text proposed by the Commission

Amendment

1b. 4. Decisions referred to in paragraph 1 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable technical and organisational measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.

noyb's comment:

Pure editorial change (referral to correct paragraph).

#1160 Article 25 – paragraphs 1 and 2 (Article 3 – paragraph 1 – point 7 a (new))

Authored by

Regulation (EU) 2016/679
Article 25 – paragraphs 1 and 2

Text proposed by the Commission

Amendment

7a. In Article 25, paragraph 1 and 2 are replaced by the following: '1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects. In doing so, particular attention shall be paid to the protection of the rights of children. 2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons. The default settings shall take into account, in particular, the vulnerability of children.'

noyb's comment:

Additional emphasis is on the protection of the rights of children - even though it is not quite clear, what this would entail.

#1178 Article 33 – paragraph 1 (Article 3 – paragraph 1 – point 8 – point a)

Authored by

Regulation (EU) 2016/679
Article 33 – paragraph 1

Text proposed by the Commission

1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.

Amendment

1. In the case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, in which case particular consideration shall be given to the risk to children, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.

noyb's comment:

The proposal basically eliminates the level of data protection lowering changes and even adds a particular consideration of the risks to children – even if it is not quite clear, what this would mean in practice. This means also an increased administrative burden for controllers and supervisory authorities compared to the Commission’s proposal. The amendments regarding the single-entry point are kept from the Commission’s proposal.

#1188 Article 33 – paragraph 1 (Article 3 – paragraph 1 – point 8 – point a)

Authored by

Regulation (EU) 2016/679
Article 33 – paragraph 1

Text proposed by the Commission

1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.

Amendment

1. In the case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.

noyb's comment:

The proposal basically eliminates the changes in the Commission’s proposal lowering the level of data protection. The switch from the current version “unless the personal data breach is unlikely” to “is likely” has probably no effect in practice. This means also an increased administrative burden for controllers and supervisory authorities compared to the Commission’s proposal. The amendments regarding the single-entry point are kept from the Commission’s proposal.

#1193 Article 33 – paragraph 6 (Article 3 – paragraph 1 – point 8 – point c)

Authored by

Regulation (EU) 2016/679
Article 33 – paragraph 6

Text proposed by the Commission

6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

Amendment

6. 6. The Board shall establish and make public common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a risk to the rights and freedoms of a natural person. The template and the list shall be available [OP date = nine months of the entry into application of this Regulation].

noyb's comment:

This amendment follows some considerations of the EDPB/EDPS opinion. The option to adopt it via implementing act is taken out of the proposal.

#1197 Article 33 – paragraph 7 (Article 3 – paragraph 1 – point 8 – point c)

Authored by

Regulation (EU) 2016/679
Article 33 – paragraph 7

Text proposed by the Commission

7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6.

Amendment

7. The template and the list referred to in paragraph 6 shall be reviewed by the Board at least every three years and updated where necessary.

noyb's comment:

This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB without significant effect on the level of data protection or simplification.

#1200 Article 33 – paragraph 7a (new) (Article 3 – paragraph 1 – point 8 – point c)

Authored by

Regulation (EU) 2016/679
Article 33 – paragraph 7a (new)

Text proposed by the Commission

Amendment

7a. In Article 33, the following paragraph 7a is inserted: '7a. The Commission may adopt the template and any updates as referred to in paragraph 6 and 7, as established by the Board, by way of an implementing act following the examination procedure set out in Article 93(2).'

noyb's comment:

This amendment seems to be related to another amendment shifting competences to the EDPB regarding the implementation of lists and templates. This amendment has little effect on the level of data protection or simplification.

#1208 Article 35 – paragraph 4 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 4

Text proposed by the Commission

4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

Amendment

4. The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

noyb's comment:

Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.

#1213 Article 35 – paragraph 5 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 5

Text proposed by the Commission

5. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.

Amendment

5. The Board shall establish and make public a list of the kind of processing operations for which no data protection impact assessment is required.

noyb's comment:

Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.

#1218 Article 35 paragraph 6 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 paragraph 6

Text proposed by the Commission

6. The Board shall prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments.

Amendment

6. The Board shall establish and make public a common template and a common methodology for conducting data protection impact assessments.

noyb's comment:

Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.

#1222 Article 35 – paragraph 1 (Article 3 – paragraph 1 – point 9 – point a a (new))

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 1

Text proposed by the Commission

Amendment

(aa) In Article 35, paragraph 1 is replaced by the following: 1. Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. Where children are affected by the processing, the risks and consequences that the processing may have on their specific rights shall be explicitly addressed. A single assessment may address a set of similar processing operations that present similar risks.

noyb's comment:

This proposal highlights the potential effects on children, providing for an increased level of data protection while the increased legal uncertainty is negligible.

#1225 Article 35 – paragraph 6a (Article 3 – paragraph 1 – point 9 – point b)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 6a

Text proposed by the Commission

6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

Amendment

6a. The lists referred to in paragraphs 4 and 5 and the template and methodology referred to in paragraph 6 shall be published within [OP date = 9 months of the entry into application of this Regulation].

noyb's comment:

This amendment seems to be related to an amendment shifting competences to the EDPB. This has no significant impact on the level of privacy or simplification.

#1229 Article 35 – paragraph 6b (Article 3 – paragraph 1 – point 9 – point b)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 6b

Text proposed by the Commission

6b. The lists and the template and methodology referred to in paragraph 6a- shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6a.

Amendment

6b. The lists and the template and methodology referred to in paragraph 6a- shall be reviewed by the Board at least every three years and updated where necessary.

noyb's comment:

This amendment seems to be related to an amendment shifting competences to the EDPB. This has no significant impact on the level of privacy or simplification.

#1230 Article 35 – paragraph ba (new) (Article 3 – paragraph 1 – point 9 – point b)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph ba (new)

Text proposed by the Commission

Amendment

6ba. In Article 35, the following paragraph 6ba is inserted: '6ba. The Commission may adopt the template and any updates referred to in paragraphs 6a and 6b, as established by the Board, by way of an implementing act following the examination procedure set out in Article 93(2).'

noyb's comment:

This amendment seems to be related to an amendment shifting competences to the EDPB. This has no significant impact on the level of privacy or simplification.

#1231 Article 35 – paragraph 6c (Article 3 – paragraph 1 – point 9 – point b)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 6c

Text proposed by the Commission

6c. Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Commission adopts the implementing act referred to in paragraph 6a.

Amendment

6c. The lists and the template and methodology referred to in paragraph 6a- shall be reviewed by the Board at least every three years and updated where necessary.

noyb's comment:

This amendment is apparently moving paragraphs around without a significant effect on privacy or simplification.

#1234 Article 35 – paragraph 7 – points c and d (Article 3 – paragraph 1 – point 9 – point b a (new))

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 7 – points c and d

Text proposed by the Commission

Amendment

(ba) In paragraph 7 of Article 35, points c and d are replaced by the following: (c) an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1, taking particular account where the personal data of a child is concerned; and (d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned, in particular children.

noyb's comment:

This proposal adds emphasis on children, increasing the level of data protection but providing for some legal uncertainty since it is not clear what this would entail.

#1245 Article 41a (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a

Text proposed by the Commission

10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as currently.

#1249 Article 29a (new) (Article 3 – paragraph 1 – point 10 – introductory part)

Authored by

Regulation (EU) 2016/679
Article 29a (new)

Text proposed by the Commission

10. The following article is added:

Amendment

10. The following article is added: 'Article 29a (new) Application of anonymisation Controllers may apply anonymisation technics in order to remove risk to the data subjects concerned. Where controllers have verifiably anonymised personal data, the Regulation shall not apply to subsequent processing. Instantly anonymising personal data shall be a legitimate interest under Article 6(1)(f), while Article 9(1) shall not apply to processing with the sole purpose of instantly anonymising personal data.'

noyb's comment:

The amendment does not include any new substantive element besides allowing legitimate interest to be the legal basis for anonymising personal data. Proper anonymization would allow use of personal data while improving the right to data protection.

#1253 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 1

Text proposed by the Commission

(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.

Amendment

(1) The European Data Protection Board (EDPB) shall issue an opinion in accordance with Article 64(2) addressing the application of pseudonymisation and anonymisation, including related technical and organisational measures, to specify the means and criteria to determine whether the application of pseudonymisation and anonymisation to personal data effectively prevents the identification of a data subject and the data subject is not or is no longer identifiable.

Justification

Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.

noyb's comment:

Read in conjunction with the following proposals: 1253, 1261, 1262, 1263, 1264, 1266, 1272, 1286, 1295, 1299. This proposal, taken as a whole, is a less radical approach in codifying the EDPS vs SRB judgement (C‑413/23 P) compared to the Commission’s proposal. The key difference is that this proposal takes away the Commission’s power to unilaterally adopt implementing acts (legally binding) and decide which pseudonymised data no longer constitutes personal data. This proposal leaves the decision to the EDPB - via an opinion (not binding legally) - and rather than relying solely on pseudonymisation, it introduces anonymisation as a technique that can (also) effectively prevent the identification of a data subject.

#1261 Article 41a – paragraph 5a (new) (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 5a (new)

Text proposed by the Commission

Amendment

(1a) In Article 41a, the following paragraph 5a is inserted: '5a. The Commission shall encourage and facilitate the drawing up of a code of conduct on the application of pseudonymisation and anonymisation, at Union level in accordance with the procedure planned in Article 40(7), in order to contribute to the proper application of this Regulation.'

Justification

Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.

noyb's comment:

Although the proposal seeks to take power away from the Commission that it seeks to afford itself via implementing acts proposed in 41a of the Digital Omnibus, it still stays overall as a decrease of protection for data subjects' fundamental rights.

#1262 Article 41a – paragraph 5b (new) (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 5b (new)

Text proposed by the Commission

Amendment

(1b) In Article 41a, the following paragraph 5b is added: '5b. When preparing a code of conduct on the application of pseudonymisation and anonymisation, in accordance with Article 40(2)(d), due account shall be taken of the European Data Protection Board (EDPB) opinion, as referred to in paragraph 1.'

Justification

Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.

noyb's comment:

Read in conjunction with the following proposals: 1253, 1261, 1262, 1263, 1264, 1266, 1272, 1286, 1295, 1299. This proposal, taken as a whole, is a less radical approach in codifying the EDPS vs SRB judgement (C‑413/23 P) compared to the Commission’s proposal. The key difference is that this proposal takes away the Commission’s power to unilaterally adopt implementing acts (legally binding) and decide which pseudonymised data no longer constitutes personal data. This proposal leaves the decision to the EDPB - via an opinion (not binding legally) - and rather than relying solely on pseudonymisation, it introduces anonymisation as a technique that can (also) effectively prevent the identification of a data subject.

#1263 Article 41a – paragraph 3 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 3

Text proposed by the Commission

Amendment

(1c) 3. When preparing a code of conduct on the application of pseudonymisation and anonymisation, in accordance with Article 40(2)(d), due account shall be taken of the European Data Protection Board (EDPB) opinion, as referred to in paragraph 1.

noyb's comment:

Read in conjunction with the following proposals: 1253, 1261, 1262, 1263, 1264, 1266, 1272, 1286, 1295, 1299. This proposal, taken as a whole, is a less radical approach in codifying the EDPS vs SRB judgement (C‑413/23 P) compared to the Commission’s proposal. The key difference is that this proposal takes away the Commission’s power to unilaterally adopt implementing acts (legally binding) and decide which pseudonymised data no longer constitutes personal data. This proposal leaves the decision to the EDPB - via an opinion (not binding legally) - and rather than relying solely on pseudonymisation, it introduces anonymisation as a technique that can (also) effectively prevent the identification of a data subject.

#1264 Article 41a – paragraph 2 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 2

Text proposed by the Commission

(2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.

Amendment

deleted

noyb's comment:

Back to current text of the GDPR.

#1266 Article 41a – paragraph 2 – point a (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a

Text proposed by the Commission

(a) assess the state of the art of available techniques;

Amendment

deleted

noyb's comment:

Back to current text of the GDPR.

#1272 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b

Text proposed by the Commission

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.

Amendment

deleted

noyb's comment:

Back to current text of the GDPR.

#1277 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)

Authored by

Katri Kulmuni

Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b

Text proposed by the Commission

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.

Amendment

(b) develop criteria and or categories for controllers and recipients to assess the risk of data being used for a purpose related to the data subject as an identified or identifiable natural person.

noyb's comment:

Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.

#1286 Article 41a – paragraph 3 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 3

Text proposed by the Commission

(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.

Amendment

deleted

noyb's comment:

Back to current text of the GDPR.

#1295 Article 41a – paragraph 4 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 4

Text proposed by the Commission

(4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.

Amendment

deleted

noyb's comment:

Back to current text of the GDPR.

#1299 Article 41a – paragraph 5 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 5

Text proposed by the Commission

(5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).

Amendment

deleted

noyb's comment:

Back to current text of the GDPR.

#1322 Article 70 – paragraph 1 – point h (Article 3 – paragraph 1 – point 13)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point h

Text proposed by the Commission

13. In Article 70(1), point (h) is deleted.

Amendment

deleted

noyb's comment:

This amendment is probably related to a separate deletion of the Commission’s proposal regarding the establishment of black-lists regarding data breaches. On its own, this amendment has no significant impact.

#1327 Article 70 – paragraph 1 – point ha (Article 3 – paragraph 1 – point 14)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point ha

Text proposed by the Commission

(ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35.

Amendment

(ha) establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35.

noyb's comment:

This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear lists simplify the application of the law.

#1330 Article 70 – paragraph 1 – point hb (Article 3 – paragraph 1 – point 14)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hb

Text proposed by the Commission

(hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

Amendment

(hb) establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

noyb's comment:

This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.

#1337 Article 70 – paragraph 1 – point hc (Article 3 – paragraph 1 – point 14)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc

Text proposed by the Commission

(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

Amendment

(hc) establish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

noyb's comment:

This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.

#1341 Article 70 – paragraph 1 (Article 3 – paragraph 1 – point 14 a (new))

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1

Text proposed by the Commission

Amendment

14a. In Article 77, paragraph 1 is replaced by the following: 1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. This right to lodge a complaint also applies when the infringing processing of personal data relating to the data subject is imminent or will take place in the near future.

noyb's comment:

Positive clarification due to CJEU case law which provides for more clarity and legal certainty as well as for a higher level of privacy.

#1366 Article 88a (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a

Text proposed by the Commission

Article 88a

Amendment

deleted

noyb's comment:

Back to the current status.

#1367 Article 88 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88

Text proposed by the Commission

Processing of personal data in the terminal equipment of natural persons

Amendment

deleted

noyb's comment:

Unclear what is exactly deleted. The whole article or just the title?

#1369 Article 88a – paragraph 1 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 1

Text proposed by the Commission

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.

Amendment

deleted

#1375 Article 88a – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 2

Text proposed by the Commission

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).

Amendment

deleted

noyb's comment:

Back to the current legal framework, which already foresees Article 23 GDPR. Not much change.

#1376 Article 88a – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 2

Text proposed by the Commission

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).

Amendment

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1), provided that any such measure is necessary and proportionate and does not require the general identification of users, nor the weakening of anonymity, encryption or other protective tools on which users, including journalists, activists and other persons at risk, rely.

noyb's comment:

Clarification that limitations to rights need to be within certain boundries which are newly defined.

#1381 Article 88a – paragraph 3 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3

Text proposed by the Commission

(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following: (a) carrying out the transmission of an electronic communication over an electronic communications network; (b) providing a service explicitly requested by the data subject; (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

Amendment

deleted

noyb's comment:

Back to the current status.

#1407 Article 88a – paragraph 3 – subparagraph (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – subparagraph

Text proposed by the Commission

Amendment

(da) In Article 88a, paragraph 3, the following sentence is added: 'The purposes listed in this paragraph shall be interpreted narrowly and shall not serve as a basis for tracking, profiling or the large-scale monitoring of the online activity of data subjects.'

noyb's comment:

Validates the exceptions proposed by the Commission, but limits their interpretation.

#1419 Article 88 – paragraph 4 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88 – paragraph 4

Text proposed by the Commission

(4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

Amendment

deleted

noyb's comment:

Removes clearer rules on the design of consent requests. Maintains more legal uncertainty.

#1421 Article 88a – paragraph 4 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4

Text proposed by the Commission

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.

Amendment

deleted

noyb's comment:

Removes clearer rules on the design of consent requests. Maintains more legal uncertainty.

#1439 Article 88a – paragraph 4 – last subparagraph (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4 – last subparagraph

Text proposed by the Commission

This paragraph also applies to the subsequent processing of personal data based on consent.

Amendment

deleted

noyb's comment:

Removes the subsequent processing based on consent given to the access to the terminal equiptment.

#1442 Article 88a – paragraph 5 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 5

Text proposed by the Commission

(5) This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation]

Amendment

deleted

noyb's comment:

No material difference.

#1456 Article 88b – title (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – title

Text proposed by the Commission

Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

Amendment

Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of data subjects

noyb's comment:

Minor clarification

#1463 Article 88b – paragraph 1 – chapeau (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 1 – chapeau

Text proposed by the Commission

(1) Controllers shall ensure that their online interfaces allow data subjects to:

Amendment

(1) Controllers shall ensure that their online interfaces allow data subjects to use automated and machine-readable means to express the following purposes:

noyb's comment:

Clarification

#1471 Article 88b – paragraph 1 – point a (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a

Text proposed by the Commission

(a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;

Amendment

(a) Give consent for all or some of the purposes requested by controllers provided that the conditions for consent laid down in this Regulation are fulfilled;

noyb's comment:

Would be a helpful clarification, however current level of the law.

#1477 Article 88b – paragraph 1 – point b (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 1 – point b

Text proposed by the Commission

(b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.

Amendment

(b) decline a request for consent.

noyb's comment:

Removes the right to object.

#1483 Article 88b – paragraph 1 – point ba (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 1 – point ba (new)

Text proposed by the Commission

Amendment

(ba) In Article 88b, paragraph 1, the following point ba is inserted: '(ba) withdraw consent;'

noyb's comment:

Includes the withdrawal of consent for automated signals.

#1484 Article 88b – paragraph 1 – point bb (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 1 – point bb (new)

Text proposed by the Commission

Amendment

(bc) In Article 88b, paragraph 1, the following point is inserted: '(bb) exercise their right to object;'

noyb's comment:

Restates the Commission idea of the right to object.

#1485 Article 88b – paragraph 1 – point bc (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 1 – point bc (new)

Text proposed by the Commission

Amendment

(be) In Article 88b, paragraph 1, the following point is added: '(bc) receive relevant information pursuant to this Regulation to make informed decision.'

noyb's comment:

Widens the scope of the Commission proposal. Allows digital display of information for controllers.

#1492 Article 88b – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 2

Text proposed by the Commission

(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.

Amendment

(2) Controllers shall respect the choices made by data subjects or authorized third-party provider of software or agents conveying choices on their behalf in accordance with paragraph 1. Where the data subject or authorized third-party agent acting on their behalf signals a refusal, withdrawal or objection pursuant to paragraph 1, the controler shall not request consent for the same purpose for a least a year.

noyb's comment:

No visible material choice, as automated choices are conveyed anyways through software. Rerequesting consent is not an issue as users are not confronted with a banner as their choice is transmitted in the background.

#1495 Article 88b – paragraph 2a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 2a (new)

Text proposed by the Commission

Amendment

(2a) In Article 88b, the following paragraph is inserted: '2a. A data subject shall not be denied access to a service or a functionality of that service based on their choices pursuant to paragraph 1, providing that consent is not strictly necessary for the functionality of that service.'

noyb's comment:

Helpful clarification to not make consent mandatory.

#1504 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 3

Text proposed by the Commission

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.

Amendment

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service and comply with Article 6 of Regulation (EU) 2024/1083. Controllers that are media service providers providing news and current affairs content pursuant to Article 6 (3) of Regulation (EU) 2024/1083 shall have the right to have their online interfaces included in recommended choices, such as whitelists, maintained by web browsers and providers of operating systems.

noyb's comment:

Reinforces the exception, even if in a more limited way. Improvement over COM proposal and current state of the law.

#1517 Article 88b – paragraph 4 – first subparagraph (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph

Text proposed by the Commission

The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices.

Amendment

The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft harmonised standards for the technical specifications, interoperable protocols, and interpretation of the automated and machine-readable indications of data subjects’ choices.

noyb's comment:

Relevant clarification and improvement of the Commission proposal.

#1534 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 6

Text proposed by the Commission

(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.

Amendment

(6) Providers of web browsers and operating systems shall: a) provide the technical means to allow data subjects to give their consent, refuse or withdraw a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article; b) ensure that their technical infrastructure allows authorized third-party software or agent providers to act on behalf of the data subject, while data subjects, upon their first use, shall be prompted to select the use of such software in online interfaces; c) not restrict, deny or degrade access or functionality to a service for any privacy-enhancing software, such as a Virtual Private Network, automated configurations, browser extensions or other technology designed to protect the confidentiality of their communication or of their terminal equipment, provided that such technologies comply with technical specifications established by the harmonised standards pursuant to paragraph 4; d) allow data subjects to import recommended choices, such as whitelists, to the technical means allowing choices, while data subjects, upon their first use, shall be prompted to allow an exception for independent media service providers pursuant to paragraph 3. e) not process the data subject’s choices referred to in paragraph 1 for any other purpose than transmitting the signal to providers of online interfaces, including in relation to software applications operating on that terminal equipment.

noyb's comment:

Expansion of automated signals to more areas.

#1548 Article 88b – paragraph 7 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 7

Text proposed by the Commission

(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].

Amendment

(7) Paragraph 6 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].

noyb's comment:

Shortens the period until postive change.

#1560 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 1

Text proposed by the Commission

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Amendment

(1) Where the processing of personal data is necessary for the development of an AI model Article 6(1)(f) the protection of interests or fundamental rights and freedom of data subject’ require at least: (a) providing data subjects with an absolute right to object to the processing of their personal data after informing the data subject under Article 13(3) or 14(4) about such processing; (b) ensuring that all personal data is immanently and effectively anonymized, according to state-of-the-art technologies, and only further processed if it is technically impossible to anonymize individual exceptionally remaining personal data; (c) relevant abstraction during the training phase from any such exceptionally remaining personal data, ensuring that any disclosure of personal data is extremely unlikely; (d) continuous testing of the AI model to ensure that the disclosure of personal data does not occur and the measures under points (a) to (c) were effective; (e) ensuring that the controller or any subsequent controller using the AI model can comply with data subject’s rights if any personal data is exceptionally remaining in, processed or disclosed by an AI model.

noyb's comment:

The proposed text includes additional safeguards for the protection of the fundamental rights and freedoms of data subjects. Clear process should allow more legal certainty than vague "safeguards".

#1572 Article 88c – paragraph 1a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 1a (new)

Text proposed by the Commission

Amendment

In Article 88c, the following paragraph is inserted: '1a. In addition to the information referred to in Article 13 and 14, the controller shall provide the data subject with details of the actions taken under paragraph 1.'

noyb's comment:

This amendment proposes a small addition to the transparency obligations of controllers, in favor of data subjects.

#1574 Article 88c – paragraph 2a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 2a (new)

Text proposed by the Commission

Amendment

In Article 88c, the following paragraph is added: '2a. Member States shall ensure that data subjects can exercise their absolute right to object under paragraph 1, subparagraph (a) with a public body, that provides such objections and pseudonymous identification data to controllers for the sole purpose of administering objections.'

noyb's comment:

This amendment proposes the administration of objections by a public body.

#1575 Article 88c – paragraph 2b (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 2b (new)

Text proposed by the Commission

Amendment

In Article 88c, the following paragraph is added: '2b. Paragraph 1 does not apply to the processing of personal data under Article 85 GDPR.'

noyb's comment:

This amendment proposes to exclude Article 85 GDPR (freedom of expression, journalism and freedom of information) data from the scope of proposed Article 88c. Unclear how this would be implemented in practice, as such data would have to be filtered. Also unclear if not the "normal" Article 6(1)(f) would still apply.

#1576 Article 88c – paragraph 2c (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 2c (new)

Text proposed by the Commission

Amendment

In Article 88c, the following paragraph is added: '2c. The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft minimum standards for anonymization and abstraction techniques under paragraph 1, subparagraph (b) and (c).'

noyb's comment:

The standardisation of anonymisation and abstraction techniques could enhance privacy standards in the EU.

#1578 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 2

Text proposed by the Commission

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as it currently is.

#1582 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 2

Text proposed by the Commission

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.

Amendment

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data. Where age assurance is necessary, it should rely on privacy-preserving and data-minimising techniques, and should not undermine the anonymity or confidentiality of communications.

noyb's comment:

The amendment does not include any new substantive element other than safeguards in the case of age assurance is needed for a processing activity.

#1722 Article 5 – paragraph 3 (Article 5 – paragraph 1 – point 2 – introductory part)

Authored by

Directive 2002/58/EC
Article 5 – paragraph 3

Text proposed by the Commission

2. After Article 5(3), the following subparagraph is added:

Amendment

2. After Article 5, the following Article is added:

noyb's comment:

No direct effect.

#1726 Article 5a (new) (Article 5 – paragraph 1 – point 2)

Authored by

Directive 2002/58/EC
Article 5a (new)

Text proposed by the Commission

This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.

Amendment

The following Article is inserted: 'Article 5a Processing of personal data in the terminal equipment of natural persons 1. Storing of personal data, or gaining of access to personal data of the data subject already stored, in the terminal equipment and any subsequent processing for the same purpose, is only allowed when that person has given his or her consent. 2. Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment and subsequent processing, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6(3) of Regulation (EU) 2016/679, to safeguard the objectives referred to in Article 23(1) of that Regulation. 3. Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment without consent, and subsequent processing, shall be lawful only to the extent it is necessary for any of the following purposes: (a) carrying out the transmission of an electronic communication over an electronic communications network; (b) providing a service, feature or content, explicitly requested by the data subject, providing that the processing is strictly limited to the specific functionality requested; (c) Measuring the audience of an online service to create aggregated information about the usage of such a service, where it is carried out by the controller or a processor solely for the use of the online service, that does not contain personal data anymore, or, exceptionally, by a third-party providers of audience measurement to a media service provider, both as defined in Regulation (EU) 2024/1083, provided they comply with the provisions of that Regulation, that such data is restricted to statistical counting, is not cross-using data from separate services, is not utilised for personalised advertising or fingerprinting, and does not involve profiling of data subject. This exception shall not apply to core platform services as defined in Regulation (EU) 2022/1925. (d) maintaining or restoring overriding interests in the technical security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service limited strictly to what is necessary for that security purpose; 4. Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse and withdraw consent in an easy, user-friendly, straightforward and intelligible manner with a prominently displayed single-click button; it shall be as easy to refuse or withdraw consent as to give it; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least one year; processing of personal data for the sole purpose of respecting such refusal shall not rely on tracking or identification beyond what is strictly necessary; (d) when online interface designs utilize an online choice architecture that includes dark patterns or other deceptive techniques to manipulate a data subject into giving consent, with the aim to distort or impair their free choice, such consent shall be invalidated; This paragraph also applies to any consent under Regulation (EU) 2026/697 and to any subsequent processing of personal data based on consent. 5. This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation].

noyb's comment:

Broader exceptions than the current framework, but more limited than the Commission. In addition, provisions for automated signals and paying with your data is not greenlighted. Overall a mixed AM that cannot be put in one category.