Martin Sonneborn

Text proposed by the Commission

[...]

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as currently.

#243 Recital 29

Authored by

Text proposed by the Commission

(29) It should be reiterated that further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. In such cases it is not necessary to ascertain on the basis of Article 6(4) of this Regulation whether the purpose of the further processing is compatible with the purpose for which the personal data are initially collected.

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as currently, as interpreted by EDPB guidelines 1/2026

#251 Recital 30

Authored by

Text proposed by the Commission

(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.

Amendment

deleted

noyb's comment:

The amendment proposed is a return to the current GDPR regime, without AI explicitly mentioned in the GDPR.

#269 Recital 31

Authored by

Text proposed by the Commission

(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, providing an unconditional right to object to the processing of their personal data, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as currently.

#296 Recital 33

Authored by

Text proposed by the Commission

(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as currently.

#311 Recital 34

Authored by

Text proposed by the Commission

(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as currently.

#323 Recital 35

Authored by

Text proposed by the Commission

(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. By contrast, it should be clarified in Article 12 of the Regulation that the right of access, which is from the outset favourable to data subjects, should not be abused in the sense that the data subjects abuse them for purposes other than the protection of their data. For example, such an abuse of the right of access would arise where the data subject intends to cause the controller to refuse an access request, in order to subsequently demand the payment of compensation, potentially under the threat of bringing a claim for damages. Other examples of abuse include situations where data subjects make excessive use of the right of access with the only intent of causing damage or harm to the controller or when an individual makes a request, but at the same time offers to withdraw it in return for some form of benefit from the controller. Moreover, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive conduct of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abuse only to a reasonable level. In any event, while requesting access under Article 15 of Regulation (EU) 2016/679 the data subject should be as specific as possible. Overly broad and undifferentiated requests should also be regarded as excessive.

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as currently.

#334 Recital 35 a (new)

Authored by

Text proposed by the Commission

Amendment

(35a) In accordance with the case-law of the Court of Justice of the European Union (judgment of 5 July 2012, Content Services, C49/11^1a), the possibility of accessing mandatory information solely via a hyperlink does not satisfy the requirements that apply to the effective provision of information, as the data subject is unable to store the information permanently and in a form that does not change. These principles, developed in Directive 2011/83/EU^2a on consumer rights, should be transferred to the duties to provide information under data protection law, to ensure that data subjects are also able to demonstrate and exercise their rights retrospectively, for example in the event of a dispute. _________________ ^1a CJEU C49/11 (Content Services), ECLI identifier: ECLI:EU:C:2012:419 ^2a Directive 2011/83/EU of the European Parliament and of the Council of 25 October 2011 on consumer rights, amending Council Directive 93/13/EEC and Directive 1999/44/EC of the European Parliament and of the Council and repealing Council Directive 85/577/EEC and Directive 97/7/EC of the European Parliament and of the Council (OJ L 304, 22.11.2011, p. 64–88, ELI: http://data.europa.eu/eli/dir/2011/83/oj)

Justification

Expanded justification relating to Article 12(1a) (new) on the provision of information under Article 13 or 14 in the form of a downloadable file.

noyb's comment:

The amendment codifies CJEU caselaw in the field of consumer rights.

#338 Recital 36

Authored by

Text proposed by the Commission

[...]

Amendment

deleted

noyb's comment:

Deletion of Commission's proposal regarding an additional exemption from the information requirement in Art 13.

#350 Recital 37

Authored by

Text proposed by the Commission

(37) Where the processing takes place for the purpose of scientific research and the provision of information to the data subject proves to be impossible or would involve a disproportionate effort it should not be necessary to provide the information provided for under Article 13 of this Regulation. The controller should make reasonable efforts to acquire contact details if they are readily available and acquisition would not require a disproportionate effort. The provision of the information would involve a disproportionate effort in particular where the controller at the time of collection of the personal data did not know or anticipate that it would process personal data for scientific research purposes at a later stage, in which case it may not have easily available contact details of the data subjects. In such situations the controller should inform data subjects indirectly, such as by making the information publicly available. The provision of such information should ensure that as many data subjects concerned as possible are reached. Relevant means to make the information publicly available should be determined depending on the context of the research project and the data subjects involved.

Amendment

deleted

noyb's comment:

Pushing back against the extension of the exemption from information obligations in the case of processing for scientific purposes, is positive for the level of data protection since it requires data subjects to be informed about the processing of their data.

#480 Recital 47

Authored by

Text proposed by the Commission

(47) Directive 2002/58/EC on privacy and electronic communications ‘ePrivacy Directive’), last revised in 2009, provides a framework for the protection of the right to privacy, including the confidentiality of communications. It also specifies Regulation (EU) 2016/679 in relation to processing of personal data in the context of electronic communication services. It protects the privacy and the integrity of user’s or subscriber’s terminal equipment used for such communications. The current provision of Article 5(3) of Directive 2002/58/EC should remain applicable insofar as the subscriber or user is not a natural person, and the information stored or accessed does not constitute or lead to the processing of personal data.

Amendment

noyb's comment:

Unclear if change means that the ePrivacy Directive remains applicable as it is or some other change is intended.

#928 Article 4 – point 1 – paragraph 2 (Article 3 – paragraph 1 – point 1 – point a)

Authored by

Regulation (EU) 2016/679
Article 4 – point 1 – paragraph 2

Text proposed by the Commission

(a) In point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as currently.

#969 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 38

Text proposed by the Commission

38. “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.

Amendment

noyb's comment:

Reduced scope of scientific research

#996 Article 5 – paragraph 1 – point b (Article 3 – paragraph 1 – point 2)

Authored by

Regulation (EU) 2016/679
Article 5 – paragraph 1 – point b

Text proposed by the Commission

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);’

Amendment

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);

Justification

Reinstatement of the currently valid text of the Regulation.

noyb's comment:

The amendment returns to the current text and pushes back against the Commission's proposal of additional derogation to Article 6(4).

#1019 Article 9 – paragraph 2 – point k (Article 3 – paragraph 1 – point 3 – point a)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k

Text proposed by the Commission

(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as currently, as interpreted by EDPB Opinion 28/2024.

#1028 Article 9 – paragraph 2 – point l (Article 3 – paragraph 1 – point 3 – point a)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 2 – point l

Text proposed by the Commission

(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.’

Amendment

deleted

Justification

In practice, alternative means of identification are almost always available, so the use of biometric data is by no means ‘necessary’. Establishing the ‘necessity’ of the use would also normalise the use of biometric data, which should be avoided.

noyb's comment:

With such deletion, the regime stays the same as currently.

#1049 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 5

Text proposed by the Commission

(5) For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as it currently is.

#1064 Article 12 – paragraph 1a (new) (Article 3 – paragraph 1 – point 3 – point b)

Authored by

Regulation (EU) 2016/679
Article 12 – paragraph 1a (new)

Text proposed by the Commission

Amendment

(5a) the following paragraph is inserted: ‘1a. Where the information referred to in Articles 13 and 14 is provided electronically, a version of that information shall be made available to the data subject for download in a structured, machine-readable and commonly used file format, in addition to any other form of provision. Simply providing a link to a website, the content of which may be unilaterally altered by the controller, does not satisfy this requirement. The obligation laid down in the first sentence shall be deemed to have been fulfilled if the data subject is offered a file for download which contains the information in full, in an unaltered and permanently retrievable form.’

Justification

The principles developed to ensure that mandatory information is accessible to consumers need to be applied to information obligations under data protection law in order to ensure that data subjects can assert and exercise their rights, even retrospectively, for example in the event of a dispute (see recital (new)).

noyb's comment:

The amendment improves the information to the data subject but may include a small technical adaptation by controllers.

#1074 Article 12 – paragraph 5 (Article 3 – paragraph 1 – point 4)

Authored by

Regulation (EU) 2016/679
Article 12 – paragraph 5

Text proposed by the Commission

4. In Article 12, paragraph 5 is replaced by the following: ‘5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.’

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as currently.

#1105 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)

Authored by

Regulation (EU) 2016/679
Article 13 – paragraph 4

Text proposed by the Commission

4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.

Amendment

4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.

noyb's comment:

Basically, deletion of Commission's proposal. Keeps status quo.

#1210 Article 35 – paragraph 4 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 4

Text proposed by the Commission

4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

Amendment

4. The Board shall prepare and publish a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

noyb's comment:

Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.

#1215 Article 35 – paragraph 5 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 5

Text proposed by the Commission

5. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.

Amendment

5. The Board shall prepare and publish a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.

noyb's comment:

Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.

#1243 Article 41a (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a

Text proposed by the Commission

10. The following article is inserted: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

Amendment

deleted

noyb's comment:

With such deletion, the regime stays the same as currently.

#1496 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 3

Text proposed by the Commission

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.

Amendment

deleted

Justification

No exemptions for media services.

noyb's comment:

Broader application for automated signals, less interruptions for users, unique simpler experience for most interfaces. Exception is questionable from an equality before the law perspective.

#1539 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 6

Text proposed by the Commission

(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.

Amendment

(6) Providers of web browsers and providers of functionally equivalent software, such as operating systems for mobile devices or connected TV devices, shall provide the technical means to allow data subjects to exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.

Justification

This is a linguistic clarification to include in the regulation operating systems for mobile devices such as smartphones and tablets, and for smart TVs, which all have functionalities that are similar to those of web browsers.

noyb's comment:

Broadens the scope of who provides "automated signals options".

#1552 Article 88c (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c

Text proposed by the Commission

Article 88c

Amendment

deleted

Justification

Article 88c is deleted in its entirety.

noyb's comment:

With such deletion, the regime stays the same as currently.

#1714 Article 5 – paragraph 3 (Article 5 – paragraph 1 – point 2)

Authored by

Directive 2002/58/EC
Article 5 – paragraph 3

Text proposed by the Commission

2. After Article 5(3), the following subparagraph is added: ‘This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.’

Amendment

deleted

noyb's comment:

Back to the current version.