40 GDPR-relevant amendments by Arba Kokalari
#83 Recital 2
Authored by
Text proposed by the Commission
(2) Union digital legislation sets high standard in the Union and can be a powerful source of competitive advantage for businesses that abide by the rules, showing a world-leading mark of quality, safety and trustworthiness. Digital regulations have framed the clear rules of the game in the Union for responsible businesses, ensuring fairness and transparency in business-to-business relations, stimulating innovative business models, setting high standard of consumer protection and safety, and for the protection fundamental rights, not least privacy and data protection.Amendment
(2) Union digital legislation sets high standard in the Union and can be a powerful source of competitive advantage for businesses that abide by the rules, showing a world-leading mark of quality, safety and trustworthiness. Digital regulations have framed the clear rules of the game in the Union for responsible businesses, ensuring fairness and transparency in business-to-business relations, stimulating innovative business models, setting high standard of consumer protection and safety, and for the protection fundamental rights, not least privacy and data protection. At the same time, the growing volume and complexity of digital regulations have increased the regulatory and administrative burden on Union businesses, thereby undermining their competitiveness.
noyb's comment:
Narrative without direct factual basis. Amounts to a political statement in a non-binding recital. No direct impact on simplification or privacy.
#87 Recital 3
Authored by
Text proposed by the Commission
(3) Union digital legislation has evolved incrementally over the past years, in response to the rapidly growing footprint of digital technologies in the Union’s economy and societal dynamic, and in view of addressing emerging challenges and promoting business opportunities in the EU. Notwithstanding the Commission’s commitment to a systematic ‘stress test’ of the digital rules, along with other Union rules, which might lead to further regulatory adjustments notably following the forthcoming Digital Fitness Check, as well as other targeted evaluations of digital rules, immediate regulatory changes are necessary. Consequently, this Regulation proposes a first set of amendments to the digital legislative framework, aimed at providing immediate regulatory clarifications that stimulate innovation in the Union market, and that cut administrative compliance costs in particular for businesses, while also streamlining supervisory and administrative costs for supervisory authorities and advisory bodies. The amendments also seek to provide clarity to individuals.Amendment
(3) Union digital legislation has evolved incrementally over the past years, in response to the rapidly growing footprint of digital technologies in the Union’s economy and societal dynamic, and in view of addressing emerging challenges and promoting business opportunities in the EU. Notwithstanding the Commission’s commitment to a systematic ‘stress test’ of the digital rules and potential overlaps of requirements, along with other Union rules, which might lead to further regulatory adjustments notably following the forthcoming Digital Fitness Check, as well as other targeted evaluations of digital rules, immediate regulatory changes are necessary. This Regulation should be seen as a first step towards further simplification of the Digital Rulebook and further efforts to reduce fragmented enforcement of Union rules. Consequently, this Regulation proposes a first set of amendments to the digital legislative framework, aimed at providing immediate regulatory clarifications that stimulate innovation in the Union market, and that cut administrative compliance costs in particular for businesses, while also streamlining supervisory and administrative costs for supervisory authorities and advisory bodies. The amendments also seek to provide clarity to individuals.
noyb's comment:
Amounts to a political wish for future simplification and consistent enforcement. No direct impact on the law.
#103 Recital 5
Authored by
Text proposed by the Commission
(5) Acknowledging the iterative evolution of horizontal and sector-specific rules, it is indispensable to address also overlaps in specific provisions that result in unnecessary duplications of administrative burdens. This is the case in requirements across several rules for reporting following cybersecurity and related incidents, where digital solutions, as proposed in this Regulation, can bring an immediate relief to businesses across all concerned sectors.Amendment
(5) Acknowledging the iterative evolution of horizontal and sector-specific rules, it is indispensable to address also overlaps in specific provisions that result in unnecessary duplications of administrative burdens and increased legal complexity. This is the case in requirements across several rules for reporting following cybersecurity and related incidents, where digital solutions, as proposed in this Regulation, can bring an immediate relief to businesses across all concerned sectors.
#227 Recital 27 a (new)
Authored by
Text proposed by the Commission
Amendment
(27a) Pseudonymised data should be presumed not to constitute personal data for an entity that has no lawful means of access to the additional information necessary for identification and no means reasonably likely to be used to identify the natural person, in line with the case-law of the Court of Justice of the European Union. That relative approach provides legal certainty for the sharing of data for research, statistics and the development of artificial intelligence, without lowering the level of protection where identification remains reasonably likely.
noyb's comment:
The amendment includes a derogation in relation to Article 4(5) which is not foreseen in the current regime. Pseudonymized data is typically covered by Article 8 of the Charter. A pure "relative" approach hence violates the Charter.
#239 Recital 28
Authored by
Text proposed by the Commission
(28) In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as methodological and systematic approach applied while conducting the research in the specific area. Research and technology development should be conducted in academic, industry and other settings, including small and medium-sized undertakings, (Article 179(2) TFEU) and should be always of a of high quality and should adhere to the principles of principles of reliability, honesty, respect and accountability (verifiability).Amendment
(28) In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as methodological and systematic approach applied while conducting the research in the specific area. Research and technology development should be conducted in academic, industry and other settings, including small and medium-sized undertakings, (Article 179(2) TFEU) and should be always of a of high quality and should adhere to the principles of principles of reliability, honesty, respect and accountability (verifiability). This does not exclude scientific research activities that further commercial interests.
noyb's comment:
Clarification but widening scope of privileged data processing.
#261 Recital 30
Authored by
Text proposed by the Commission
(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. To develop and use reliable AI systems, it is necessary to improve access to qualitative data in Europe. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.
noyb's comment:
The purpose of the proposed addition is unclear, but hints at allowing access to (personal) data for AI training.
#264 Recital 30 a (new)
Authored by
Text proposed by the Commission
Amendment
(30a) The simplification of the Union's digital acquis, including of Regulation (EU) 2024/1689, should not be a one-off exercise but a continuous task. This Regulation and the parallel proposal amending Regulation (EU) 2024/1689 (Digital Omnibus on AI) constitute only first steps towards a simpler, innovation-friendly regulatory framework. In line with the Union's targets of reducing administrative costs by at least 25 %, and by at least 35 % for SMEs, the Commission should continuously monitor the administrative burden arising from the digital acquis, in particular for SMEs and small mid-cap companies. As a next step, the Commission should present a broader and more comprehensive digital simplification package, covering the whole digital acquis.
noyb's comment:
The recital does not highlight fundamental rights. On the contrary, it highlights innovation and the need to overhaul the EU digital acquis. However, it highlights simplifiction..
#964 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38
Text proposed by the Commission
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.Amendment
(38) “scientific research” means any research which can also support innovation, such as technological development, demonstration, applied research and privately funded research. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude research testing or development of AI systems or AI models prior to their being placed on the market or put into service or the aim to further a commercial interest.
noyb's comment:
Can be read to presume that AI system development is scientific research
#1041 Article 9 – paragraph 2 – point la (new) (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point la (new)
Text proposed by the Commission
Amendment
(la) In Article 9, paragraph 2, the following point is inserted: '(la) processing is necessary for the purpose of scientific research by a recognised organisation that is subject to a Data Protection Impact Assessment, a recognised ethics committee, appropriate technical and organisational measures including pseudonymisation and public registration.'
noyb's comment:
The amendment includes more derogations than the Commission's proposal and subjects the processing to additional formalities.
#1044 Article 9 – paragraph 2 – point lb (new) (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point lb (new)
Text proposed by the Commission
Amendment
(lb) in Article 9, paragraph 2, the following point is added: 'lb. processing is necessary for the purposes of carrying out obligations set by other Union law, without cross-references to Regulation (EU) 2016/679.'
noyb's comment:
No relevant change compared to Article 9(2)(g) GDPR. Any such law must be "proportinate" under Article 8 and 2 of the Charter.
#1062 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 5
Text proposed by the Commission
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Amendment
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to mitigate risks associated with the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being disclosed or otherwise made available to third parties.
noyb's comment:
The amendment does not include any new substantive element.
#1071 Article 9 – paragraph 1 (Article 3 – paragraph 1 – point 3 a (new))
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 1
Present text
Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.Amendment
"Processing of personal data directly revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited."
noyb's comment:
This proposal undermines the current level of protection of the GDPR while violating Articles 8 and 52 CFREU.
#1090 Article 12 – paragraph 5 – last subparagraph (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5 – last subparagraph
Text proposed by the Commission
The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.Amendment
deleted
noyb's comment:
The amendment removes the burden of proof of controllers, it goes further than the Commission's proposal.
#1154 Article 22 – paragraph 1 – point ca (new) (Article 3 – paragraph 1 – point 7)
Authored by
Regulation (EU) 2016/679
Article 22 – paragraph 1 – point ca (new)
Text proposed by the Commission
Amendment
(ca) is taken by an AI system which can be reviewed and overseen by a natural person before or after it takes effect, and where appropriate safeguards are in place;
noyb's comment:
Introduces a rather broad exemption from the general ADM prohibition withoug any regard on necessity. This proposal also introduces legal uncertainty since it is not clear, what appropriate safeguards would be and how a "review" or "oversight" after the decision takes effect should be understood.
#1194 Article 33 – paragraph 6 (Article 3 – paragraph 1 – point 8 – point c)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 6
Text proposed by the Commission
6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).Amendment
6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2). This shall not go beyond existing obligations under this Regulation or mandate any retroactive obligations.
noyb's comment:
This provision provides for a mere clarification. Even if the clarification is stated one-sided it does not have a significant effect on privacy or simplification.
#1259 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 1
Text proposed by the Commission
(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.Amendment
(1) The Commission may adopt implementing acts to specify means and criteria to determine when data no longer constitutes personal data for certain entities.
noyb's comment:
The amendment improves the Commission's proposal but risks remaining a decrease of protection compared to the current Article 4(1) and overall standards of what counts as personal data. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1268 Article 41a – paragraph 2 – point a (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
Text proposed by the Commission
(a) assess the state of the art of available techniques;Amendment
(a) assess the state of the art of available techniques , including Privacy Enhancing Technologies (PET);
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights.Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1279 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
Text proposed by the Commission
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.Amendment
(b) develop criteria and or categories for controllers and recipients to assess the risk of data being used for a purpose related to the data subject as an identifiable natural person
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1292 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 1
Text proposed by the Commission
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.Amendment
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot be used for any purpose related to the data subjects as an identifiable natural person.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1296 Article 41a – paragraph 4 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 4
Text proposed by the Commission
(4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.Amendment
(4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion, which shall be made public, on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Decisions on the application of the law are generally reserved to independent SAs under Article 8(3) of the Charter.
#1335 Article 70 – paragraph 1 – point hc (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc
Text proposed by the Commission
(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33Amendment
(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely and not likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33
noyb's comment:
This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear lists simplify the application of the law.
#1371 Article 88a – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 1
Text proposed by the Commission
(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.Amendment
(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person shall be lawful where such processing is carried out in accordance with this Regulation and on the basis of Article 6 of this Regulation.
#1374 Article 88a – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 2
Text proposed by the Commission
(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).Amendment
deleted
noyb's comment:
Back to the current legal framework, which already foresees Article 23 GDPR. Not much change.
#1384 Article 88a – paragraph 3 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3
Text proposed by the Commission
(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:Amendment
(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful for any of the following:
#1401 Article 88a – paragraph 3 – point d (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point d
Text proposed by the Commission
(d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.Amendment
(d) maintaining or restoring the security and integrity of a service provided by the controller, including fraud prevention or technical incidents, of the terminal equipment used for the provision of such service.
#1408 Article 88a – paragraph 3 – point da (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)
Text proposed by the Commission
Amendment
(da) In Article 88a, paragraph 3, the following point da is added: '(da) processing where the controller deploys recognised Privacy Enhancing Technologies (PETs) that effectively mitigate risks associated to the processing of personal data.'
noyb's comment:
New very broad exception introduced. Vague, given that PETs are not defined and often amount to "privacy washing".
#1415 Article 88a – paragraph 3a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3a (new)
Text proposed by the Commission
Amendment
(3a) In Article 88a, the following paragraph 3a is added: '3a. For any other purpose than those referred to in the second subparagraph, the processing shall comply with Article 6 and, where applicable, with Article 9.'
noyb's comment:
Basically allows more legal basis (Article 88a + 6 and 9) for the access to other people's smart phones, PCs or servers. May go beyond what the CJEU would accept under Article 7 of the Charter. Consistency between ePrivacy and GDPR would however be "simpler".
#1446 Article 88b (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b (new)
Text proposed by the Commission
Article 88bAmendment
deleted
#1451 Article 88b – title (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – title
Text proposed by the Commission
Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural personsAmendment
deleted
#1459 Article 88b – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1
Text proposed by the Commission
(1) Controllers shall ensure that their online interfaces allow data subjects to: (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.Amendment
deleted
#1491 Article 88b – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 2
Text proposed by the Commission
(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.Amendment
deleted
#1503 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 3
Text proposed by the Commission
(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.Amendment
deleted
noyb's comment:
Broader application for automated signals, less interruptions for users, unique simpler experience for most interfaces. Exception is questionable from an equality before the law perspective.
#1509 Article 88b – paragraph 4 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4
Text proposed by the Commission
(4) The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.Amendment
deleted
#1510 Article 88b – paragraph 4 – first subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph
Text proposed by the Commission
The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices.Amendment
deleted
#1521 Article 88b – paragraph 4 – second subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – second subparagraph
Text proposed by the Commission
Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.Amendment
deleted
#1525 Article 88b – paragraph 5 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 5
Text proposed by the Commission
(5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].Amendment
deleted
noyb's comment:
Can be read as good for privacy (shortening the time for application) or as negative as a part of deleting the article, given that an implementation in 20 days [when the Article would apply] seems too ambitious.
#1530 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 6
Text proposed by the Commission
(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.Amendment
deleted
#1546 Article 88b – paragraph 7 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 7
Text proposed by the Commission
(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].Amendment
deleted
noyb's comment:
Can be read as good for privacy (shortening the time for application) or as negative as a part of deleting the article, given that an implementation in 20 days [when the Article would apply] seems too ambitious.
#1570 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 1
Text proposed by the Commission
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Amendment
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679 except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject in accordance with Articles 6 and 21 of this Regulation, in particular where the data subject is a child.
#1573 Article 88c – paragraph 2a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2a (new)
Text proposed by the Commission
Amendment
In Article 88c, the following paragraph is added: '2a. The Commission shall issue guidelines on the assessment of legitimate interests in the context of training and testing of AI systems and AI models.'
noyb's comment:
This proposal leaves the interpretation of Article 6(1)(f) GDPR to the Commission which would be the task of the EDPB. This may also violate Article 8(3) of the Charter.