19 GDPR-relevant amendments by Damian Boeselager
#1355 Article 83 – paragraph 5 – point ea (new) (Article 3 – paragraph 1 – point 14 e (new))
Authored by
Regulation (EU) 2016/679
Article 83 – paragraph 5 – point ea (new)
Text proposed by the Commission
Amendment
14e. In Article 83, paragraph 5, the following point ea is added: '(ea) obligations related to automated and machine-readable signals of data subject’s choices with respect to processing of personal data in the terminal equipment pursuant to Article 88b;'
#1365 Article 88a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a
Text proposed by the Commission
Article 88aAmendment
deleted (The deletion applies to the whole Article 88a.)Justification
Article 88a moved back to the ePrivacy Directive
#1457 Article 88b – title (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – title
Text proposed by the Commission
Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural personsAmendment
Automated and machine-readable signals of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons
#1464 Article 88b – paragraph 1 – chapeau (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – chapeau
Text proposed by the Commission
(1) Controllers shall ensure that their online interfaces allow data subjects to:Amendment
(1) Controllers shall ensure that their online interfaces allow data subjects to signal, through automated and machine-readable means:
#1470 Article 88b – paragraph 1 – point a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a
Text proposed by the Commission
(a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;Amendment
(a) the data subject’s consent for a specific controller and a specified purpose based on actively given consent by them under the conditions for consent laid down in this Regulation;Justification
Consent needs to be informed and can therefore only be given by the data subject themself for the first time.
#1476 Article 88b – paragraph 1 – point b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point b
Text proposed by the Commission
(b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.Amendment
(b) the refusal to give a requested consent and the exercise the right to object pursuant to Article 21(1), Article 21(2), and Article 21(5);Justification
Important to cover all options under Article 21, including the already existing 21(5) on automated exercise of the right to object.
noyb's comment:
Broadens the scope of the right to object, otherwise clarification.
#1482 Article 88b – paragraph 1 – point ba (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point ba (new)
Text proposed by the Commission
Amendment
(ba) In Article 88b, paragraph 1, the following point ba is inserted: '(ba) the withdrawal of consent pursuant to Article 7(3);'
#1493 Article 88b – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 2
Text proposed by the Commission
(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.Amendment
(2) The signals in accordance with paragraph 1 shall be legally valid and be binding on, and enforceable against, the controller and any other party. Controllers shall not make requests for consent for the same purpose through different means. Controllers shall not override the choice made through automated and machine-readable means unless the data subject explicitly requests it.Justification
Wording from the EP mandate on the ePrivacy Reform in 2017
noyb's comment:
Not rerequesting consent through other means is a useful addition that simplifies the situation for everyone involved, as you can rely on automated signals..
#1498 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 3
Text proposed by the Commission
(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.Amendment
deletedJustification
No black/white exemption, but exemption from the need to have consent in the first place in Art. 88a (now moved to ePrivacy) for audience measurement.
noyb's comment:
Broader application for automated signals, less interruptions for users, unique simpler experience for most interfaces. Exception is questionable from an equality before the law perspective.
#1514 Article 88b – paragraph 4 – first subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph
Text proposed by the Commission
The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices.Amendment
By [OP: insert the date: 6 months after entry into force of this amending Regulation], the Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to, within one year after receiving the request, draft standards for the interpretation of machine-readable indications of data subjects’ choices. The standards shall allow for the providers of the technical means and controllers to comply with this Article. When preparing the standardisation request, the Commission shall consult the European Data Protection Board and the European Data Protection Supervisor.
#1522 Article 88b – paragraph 4 – second subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – second subparagraph
Text proposed by the Commission
Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.Amendment
deletedJustification
Moved to new paragraph 4b to also cover common specifications as per 4a.
#1523 Article 88b – paragraph 4a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4a (new)
Text proposed by the Commission
Amendment
(4a) In Article 88b, the following paragraph is inserted: '4a. The Commission shall adopt implementing acts establishing common specifications for the requirements set out in paragraphs 1 and 2, where the following conditions have been fulfilled one year after the request pursuant to paragraph 4 has been made: (a) the request pursuant to paragraph 4 has not been accepted by any of the European standardisation organisations; or (b) the harmonised standards addressing that request are not delivered within the deadline set in paragraph 4 and in accordance with Article 10(1) of Regulation (EU) No 1025/2012; or (c) the harmonised standards do not comply with the request; and (d) no reference to harmonised standards covering the requirements referred to in paragraphs 1 and 2 has been published in the Official Journal of the European Union in accordance with Regulation (EU) No 1025/2012.'Justification
modeled after Article 41 AI Act
#1524 Article 88b – paragraph 4b (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4b (new)
Text proposed by the Commission
Amendment
(4b) In Article 88b, the following paragraph is inserted: '4b. Online interfaces of controllers which are in conformity with harmonised standards or common specifications or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.'Justification
moved here from paragraph 4 last sub-paragraph, so it also covers common specifications as per paragraph 4a (new)
#1529 Article 88b – paragraph 5 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 5
Text proposed by the Commission
(5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].Amendment
(5) Paragraphs 1 and 2 shall apply 12 months following the publication of the standards or the common specifications pursuant to paragraph 4 or 4a.
#1535 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 6
Text proposed by the Commission
(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.Amendment
(6) Providers of web browsers, applications and operating systems shall provide the technical means to allow data subjects to give their consent for specific controllers and specified purposes, to refuse a request for consent, to withdraw consent, and to exercise the right to object through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. Nothing in this paragraph shall preclude a provider of a web browser, an application, or an operating system from configuring the technical means referred to in this paragraph to convey, by default, a refusal of consent and an exercise of the right to object referred to in point (b) of paragraph 1, in line with the requirements of Article 24(4).Justification
Necessary to expand the obligation to any software that allows using information society services.
noyb's comment:
Expands obligation to provide options beyond the Commission proposal.
#1540 Article 88b – paragraph 6a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 6a (new)
Text proposed by the Commission
Amendment
(6a) In Article 88b, the following paragraph is inserted: '6a. Where a provider referred to in paragraph 6 qualifies as a gatekeeper in the meaning of Regulation (EU) 2022/1925, the provider shall enable third-party providers acting structurally and economically independently from it to provide the technical means to convey the data subject's choices referred to in paragraph 1 through the automated and machine-readable means referred to in paragraph 6, as applied pursuant to paragraphs 2 to 5. This paragraph shall not be construed as requiring the provider of a web browser to grant third-party software, including a browser extension, access to data or functionality of the web browser beyond what is necessary to convey to controllers the choices made by data subjects in accordance with paragraph 1.'Justification
Unbundling for browser, app or operating system providers that qualify as gatekeepers under the Digital Markets Act.
#1541 Article 88b – paragraph 6b (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 6b (new)
Text proposed by the Commission
Amendment
(6b) In Article 88b, the following paragraph is inserted: '6b. Providers referred to in paragraph 6, when providing technical means, shall: (a) ensure that conditions laid down in this Article and Article 5(5) of Directive 2002/58/EC are complied with; (b) enable the data subject to pick an option to decline requests for consent, object or withdraw consent for specific purposes or all purposes; (c) enable the data subject to make choices specific to each controller without engaging in any form of differentiated or preferential treatment for specific controllers; (d) not implement practices that materially distort or impair, either on purpose or in effect, the ability of the data subject to make autonomous and informed choices or decisions; (e) ensure that controllers can appropriately inform the data subject in accordance with this Regulation, including on the consequences to decline requests for consent or withdraw consent;'
noyb's comment:
Details the Commission proposal further, contributes to more legal certainty.
#1547 Article 88b – paragraph 7 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 7
Text proposed by the Commission
(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].Amendment
(7) Paragraph 6 shall apply from [OP: please insert the date = 12 months following publication of the standards or the common specifications pursuant to paragraph 4 and 4a].
#1725 Article 5 – paragraph 3a (new) (Article 5 – paragraph 1 – point 2)
Authored by
Directive 2002/58/EC
Article 5 – paragraph 3a (new)
Text proposed by the Commission
This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.Amendment
In Article 5, the following paragraph is added: '3a. Member States shall ensure that the storing of information, or gaining of access to information already stored, in the terminal equipment of a natural person without specific consent, shall be lawful to the extent it is strictly technically and solely necessary for any of the following purpose: (a) carrying out or facilitating the transmission of an electronic communication over an electronic communications network; (b) providing an information society service specifically requested by the natural person; (c) measuring the audience of an information society service explicitly requested by the data subject by creating instantly anonymous aggregated information about the usage of that service, where (i) it is carried out by the provider of that service, or by a processor acting on behalf of this provider, or by an entitled and independent third party performing audience measurement in accordance with Article 24 of Regulation (EU) 2024/1083. This provision does not apply to gatekeepers within the meaning of Regulation (EU) 2022/1925; (ii) it is carried out solely for the provider’s own use and not processed for other purposes; (iii) the data is not combined with data from other services from the provider service, or from a third party, nor shared with a third party except for third parties referred to in point (i); (iv) such measurement does not adversely affect the fundamental rights of the natural person; and (v) the natural person is given a possibility to object; (d) maintaining or restoring the security, confidentiality, integrity, availability and authenticity of the terminal equipment of the user, by means of updates, for the duration necessary for that purpose of a service provided by the controller and explicitly requested by the user or the terminal equipment used for the provision of such service given that (i) such interest is not overridden by the interests or fundamental rights and freedoms of the data subject; (ii) the user is informed about the storing or gaining access and their purpose; (iii) a genuine choice is given to the user to postpone and decide on the automatic nature of such updates, except in the case of a vulnerability presenting a significant cybersecurity risk; and (iv) this does not in any way change the functionality of the hardware or software or the privacy settings chosen by the user; (e) complying with paragraph 4 point c of this Article, without storing personal data including unique identifiers; 5. Member States shall ensure that where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a prominently displayed single-click button; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose; (d) the interface used to request consent shall be presented in a machine-readable format. 6. Member States shall ensure that no user shall be denied access to any information society service or functionality, regardless of whether this service is remunerated or not, on grounds that he or she has not given his or her consent to the processing of personal information and/or the use of processing or storage capabilities of his or her terminal equipment that is not necessary for the provision of that service or functionality. 7. Member States shall ensure that the conditions for giving, refusing or withdrawing consent using automated and machine-readable signals pursuant to Article 88b of Regulation (EU) 2016/679 shall also apply to this Article. 8. This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation].Justification
Article 88a moved back to ePrivacy, in order to avoid that non-personal data is protected better than personal data stored in the terminal equipment.
noyb's comment:
Broader exceptions than the current framework, but more limited than the Commission. In addition, provisions for automated signals and paying with your data is not greenlighted. Overall a mixed AM that cannot be put in one category.