Svenja Hahn

Text proposed by the Commission

Amendment

(32a) The training of AI systems and AI models can constitute a legitimate interest of the controller within the meaning of Article 6(1), point (e), where such training is necessary for the development of AI systems and AI models.

Text proposed by the Commission

(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.

Amendment

(34) Processing of biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric recognition includes two distinct functions, namely the identification of a natural person or the verification of their claimed identity according to Article 3 (35) and (36) of Regulation (EU) 2024/1689. Derogating from the prohibition to process biometric data under Article 9(1) of Regulation (EU) 2016/679 should be allowed where the verification and identification of the data subject is necessary and proportionate for a purpose pursued by the controller. The derogation should only apply where the data subject is offered a non-biometric alternative and appropriate safeguards laid down under Union law are implemented to ensure fundamental rights of the data subject are adequately protected. It should be ensured that no photo or video is captured, even if not recorded and not processed, from individuals who do not consent to the facial recognition through appropriate measures. For example, where the biometric data are securely stored solely on the device of the data subject or are securely stored by the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is securely held solely by the data subject and subject to measures ensuring the overall security of processing, including during the enrolment phase of the data subject’s biometric data during the verification process. Such verification may in particular be required in the context of electronic identification systems and trust services under Union law. Other examples of appropriate safeguards are ensuring that end-to-end encryption is used when data are transmitted over a communication channel and providing data subjects with the possibility to securely rectify or delete their biometric data at any time.

Text proposed by the Commission

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

Amendment

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. The parameters of a trained AI model do not constitute personal data where, taking into account the means reasonably likely to be used, a natural person whose personal data was processed during training cannot be identified from the model.

Text proposed by the Commission

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.

Amendment

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. The development, training, testing and validation of new technologies, such as AI systems, AI models and AI agents may be topics of scientific research where it meets the conditions of this point.

Text proposed by the Commission

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);

Amendment

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or for the development, training, testing, validation or use of new technical solutions based on aggregated data, including AI systems and AI models, subject to the safeguards in Article 88c and without prejudice to Article 9 shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);

Text proposed by the Commission

(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.

Amendment

(l) processing of biometric data is necessary for the purpose of verifying the identity or identifying a data subject, provided that biometric data is optional, the data subject has access to a non-biometric alternative of comparable effectiveness and that no photo or video is captured from individuals who do not consent to the facial recognition, and that appropriate safeguards laid down under Union law are applied to ensure the protection of fundamental rights of the data subject.