56 GDPR-relevant amendments by François-Xavier Bellamy
#220 Recital 27
Authored by
Text proposed by the Commission
(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council15 . The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act. _________________ 15 Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (OJ L, 2025/327, 5.3.2025, ELI: http://data.europa.eu/eli/reg/2025/327/oj)Amendment
(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable for a given entity. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council15 . The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act. (Recital 27 - Regulation (EU) 2016/679) _________________ 15 Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (OJ L, 2025/327, 5.3.2025, ELI: http://data.europa.eu/eli/reg/2025/327/oj)
noyb's comment:
The amendment does not include any new substantive element, it merely further emphasises the Commission's proposed subjective nature of Article 4(1).
#291 Recital 32 a (new)
Authored by
Text proposed by the Commission
Amendment
(32a) The possibility of drawing conclusions regarding a data subject's health status through the combination, analysis or contextual interpretation of other data should not, in itself, result in the classification of such data as data concerning health for the purposes of Article 9. Data should only fall within the special category referred to in Article 9(1) where it directly and inherently discloses information concerning health, and not merely because such information could, in principle, be derived from it by a third party through further processing, enrichment or analysis.
noyb's comment:
The amendment restrains the scope of the definition in Article 9.
#310 Recital 33 a (new)
Authored by
Text proposed by the Commission
Amendment
(33a) To ensure legal certainty and support the responsible development and use of artificial intelligence in the Union, it should be clarified that processing of personal data in the context of development, deployment, training, testing, operation and improvement of AI systems or models, including related products and services, may constitute a lawful ground under this Regulation where the conditions laid down in Article 9(2), point (k), are met.
#467 Recital 46
Authored by
Text proposed by the Commission
(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser or in the EU Digital Identity Wallet as set out by Regulation (EU) 914/2014, or any other adequate means. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, media service providers should not be obliged to respect the machine-readable indications of data subject’s choices. The obligation for providers of web browsers to provide the technical means for data subjects to make choices with respect to the processing should not undermine the possibility for media service providers to request consent by data subjects.Amendment
(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser or in the EU Digital Identity Wallet as set out by Regulation (EU) 914/2014, or any other adequate means. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, media service providers should not be obliged to respect the machine-readable indications of data subject’s choices. The obligation for providers of web browsers to provide the technical means for data subjects to make choices with respect to the processing should not undermine the possibility for media service providers to request consent by data subjects. To support media sustainability in Europe, Media Service Providers can ask for consent or establish necessary conditions for other legal bases for third parties as long as that is done for data processing required to support the functioning or funding of Media Service Providers and is conducted exclusively on their properties.
noyb's comment:
Goes back beyond the Commission proposal. Tries to grant legislative powers to Media Service Providers?!
#941 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – second part
Text proposed by the Commission
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.Amendment
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. The means reasonably likely to be used by a specific entity shall be assessed in the light of that entity's actual technical capabilities, having regard to the ressources, costs, available technical means and time required for identification, rather than hypothetical possibilities.
noyb's comment:
The amendment includes more derogations than the Commission's proposal.
#943 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – second part
Text proposed by the Commission
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.Amendment
Information relating to a natural person, is not personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. That assessment shall take into account objective factors, including but not limited to costs, time, available technology and the legal means available to that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.
noyb's comment:
The amendment does not materially change the Commission's proposal, thus overall remains a decrease of protection compared to the current Article 4(1).
#948 Article 4 – point 15 (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 15
Text proposed by the Commission
Amendment
(15) ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status; Data that merely allow such information to be inferred indirectly shall not be considered data concerning health;
noyb's comment:
Lowering the protections for health data (e.g. person buying HIV medicine would not be covered anymore under Article 9 because the person could buy it for someone else).
#953 Article 4 – point 33 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 33
Text proposed by the Commission
(33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply;Amendment
(33) electronic communications networks’ means transmission systems as defined in of Article 2(1) of Directive (EU) 2018/1972;
#971 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38
Text proposed by the Commission
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.Amendment
(38) “scientific research” means creative and systematic work undertaken in order to increase the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts without any particular application or use in view, or through original investigation undertaken in order to acquire new knowledge directed primarily towards a specific, practical aim or objective. This does not exclude that the research may also aim to further a commercial interest.
#1057 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 5
Text proposed by the Commission
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Amendment
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented, in accordance with Article 89 safeguards to limit the processing of special categories of personal data and to mitigate the risk associated with the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall ensure that such data are processed under one or more of the conditions referred to in paragraph 2, points a to j, or remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’
noyb's comment:
The amendment proposes to have a "fall-back" Article 9(2) legal basis for residual special categories of personal data which is a wider allowance than initially proposed by the Commission.
#1096 Article 12 – paragraph 5 – last subparagraph (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5 – last subparagraph
Text proposed by the Commission
Amendment
In Article 12, paragraph 5, the following subparagraph is added: 'The Commission may adopt implementing acts to further specify criteria for what constitutes a manifestly unfounded or excessive character of the request.'
noyb's comment:
The amendment puts the Commission in the position to impair the scope of the right to access and to apply the GDPR, which is reserved to DPAs under Article 8(3) of the Charter.
#1112 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)
Authored by
Regulation (EU) 2026/679
Article 13 – paragraph 4
Text proposed by the Commission
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.Amendment
4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information or where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.’
noyb's comment:
Small amendments to the Commission's proposal. Mainly clarififying that the proposal provides for an additional exemption. A lack of information typcially violates the "fairness" principle in Article 8(2) of the Charter.
#1123 Article 13 – paragraph 5 (Article 3 – paragraph 1 – point 6)
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 5
Text proposed by the Commission
5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.Amendment
5. When the processing takes place for scientific research purposes, including scientific research in the public interest aiming to further a commercial interest, and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort, including cases where the change of purpose could not have been anticipated at the time of collection, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available. This scenario shall apply equally to the obligations under Article 14(5)(b).
noyb's comment:
This proposal builds upon the Commission's proposal, but even decreases the level of privacy in those cases. It may violate the purpose limitation and fairness principle in Article 8(2) of the Charter.
#1192 Article 33 – paragraph 6 (Article 3 – paragraph 1 – point 8 – point c)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 6
Text proposed by the Commission
6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).Amendment
6. The Board shall establish and make public common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person and a list of the circumstances in which it is not likely to result in such a high risk.. The template and lists shall be available to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2). 7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6.’
noyb's comment:
This amendment, in particular, follows some considerations of the EDPB/EDPS opinion and adds the creation of a white-list the documents the Board shall establish, providing increased legal certainty.
#1209 Article 35 – paragraph 4 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 4
Text proposed by the Commission
4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.Amendment
4. The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.
noyb's comment:
Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.
#1214 Article 35 – paragraph 5 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 5
Text proposed by the Commission
5. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.Amendment
5. Processing operations not covered by the list in paragraph 4 shall not be subject to the requirement for a data protection impact assessment pursuant to paragraph 1.
noyb's comment:
This template would reduce factually reduce the cases in which a controller would prepare a DPIA, resulting in a lower level of data protection but less administrative work for controllers.
#1217 Article 35 – paragraph 6 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 6
Text proposed by the Commission
6. The Board shall prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments.Amendment
6. The Board shall establish a common template and a common methodology for conducting data protection impact assessments.
noyb's comment:
Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.
#1224 Article 35 – paragraph 6a (Article 3 – paragraph 1 – point 9 – point b)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 6a
Text proposed by the Commission
6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).Amendment
6a. The proposal for the list referred to in paragraph 4 and for the template and methodology referred to in paragraph within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2). That list shall be based on convergence area from national authorities and shall not introduce new categories of processing operations that go beyond existing obligations under this Regulation. Processing operations lawfully in place at the time of their initiation shall not be subject to a retroactive obligation to carry out a data protection impact assessment as a result of the adoption of the harmonised list.
noyb's comment:
This proposal (apparently subject to editorial mistakes) tries to narrow the scope of potential processing activities subject to a DPIA; therefore, it lowers the level of data protection. It also introduces some legal uncertainty, offsetting a potential reduction in administrative workload.
#1254 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 1
Text proposed by the Commission
(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.Amendment
(1) The Commission may adopt implementing acts to specify technical and organisational measures and criteria supporting controllers in assessing whether data resulting from anonymisation or pseudonymisation no longer constitutes personal data for certain entities and in preventing the risk of re-identification.
noyb's comment:
The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1) and 4(6).
#1256 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 1
Text proposed by the Commission
(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.Amendment
(1) The Commission may adopt implementing acts to specify the technical means and any relevant criteria to determine whether data resulting from pseudonymisation constitutes anonymized data that no longer constitutes personal data for a specific entity. (Article 41 new of Regulation (EU) 2016/679)
noyb's comment:
The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1), and CJEU case law, such as C-319/22 Gesamtverband Autoteile-Handel eV v. Scania.
#1269 Article 41a – paragraph 2 – point a (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
Text proposed by the Commission
(a) assess the state of the art of available techniques;Amendment
(a) assess the state of the art of available techniques, such as privacy- enhancing technologies;
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1271 Article 41a – paragraph 2 – point a (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
Text proposed by the Commission
(a) assess the state of the art of available techniques;Amendment
(a) assess the state of the art of available technical means;
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1273 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
Text proposed by the Commission
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.Amendment
(b) develop criteria to assess the risk of re-identification in practice in relation to typical recipients of data. The criteria should take into account, inter alia, the likelihood of identifying a natural person, the possibility of linking records relating to a natural person, and the potential of inferring information concerning a natural person.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1275 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
Text proposed by the Commission
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.Amendment
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data, taking into account objective factors such as cost, amount of time required, available technology, legal obligations.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1281 Article 41a – paragraph 2 – point ba (new) (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point ba (new)
Text proposed by the Commission
Amendment
(ba) In Article 41a, paragraph 2, the following point ba is added: '(ba) assess technical, administrative, organisational and contractual measures that can prevent the risk of re-identification.'
noyb's comment:
Does not add anything material towards the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1289 Article 41a – paragraph 3 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 3
Text proposed by the Commission
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.Amendment
(3) The implementation of the technical and organisational measures and criteria outlined in an implementing act may be used as an element to demonstrate that pseudonymised data do not lead to reidentification of the data subjects in a specific case.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1294 Article 41 new – paragraph 3 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41 new – paragraph 3
Text proposed by the Commission
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.Amendment
(3) The implementation of the means and criteria outlined in an implementing act may be used by an entity as an element to demonstrate that data cannot lead to reidentification of the data subjects by that entity.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. The "fully subjective" approach is not alinged with Article 8 of the Charter as interpreted by the CJEU (see e.g. Fashion ID).
#1312 Article 57 – paragraph 1 – point aa (new) (Article 3 – paragraph 1 – point 11 – point a a (new))
Authored by
Regulation (EU) 2016/679
Article 57 – paragraph 1 – point aa (new)
Text proposed by the Commission
Amendment
(aa) In Article 57, paragraph 1, the following point aa is inserted: '(aa) handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80 and investigate, in the case of a complaint by a data subject at its discretion, to the extent approriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisor authority is necessary;'
noyb's comment:
The amendment gives more discretion to supervisory authorities, which could lead to less complaint handling. The lack of a remedy (beyond civil courts) could violate Article 8(3) and 47 of the Charter.
#1314 Article 57 – paragraph 1 – va (Article 3 – paragraph 1 – point 11 – point a b (new))
Authored by
Regulation (EU) 2016/679
Article 57 – paragraph 1 – va
Text proposed by the Commission
Amendment
(ab) In Article 57, paragraph 1, the following point va is added: '(va) set up regulatory sandboxes to facilitate testing the compliance of specific techniques or technological solutions to be used for the data processing activities with the obligations under this Regulation or whether the data processing results in data that would be exempt from this Regulation.'
noyb's comment:
The amendment provides for compliance tools to be put in place by the supervisory authorities, ultimately shifting compliance to them. The fact that a full excemption from the Regulation is granted would undermine the rights under the GDPR.
#1326 Article 70 – paragraph 1 – point ha (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point ha
Text proposed by the Commission
(ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35.Amendment
(ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment, pursuant to Article 35.
noyb's comment:
On its own, this amendment has no significant impact. Clear lists simplify the application of the law.
#1331 Article 70 – paragraph 1 – point hb (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hb
Text proposed by the Commission
(hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.Amendment
(hb) establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.
noyb's comment:
This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.
#1394 Article 88a – paragraph 3 – point c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c
Text proposed by the Commission
(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;Amendment
(c) (c) creating information about the usage of an online service to measure the audience of such a service, where it is carried out at the direction of the controller of that online service, or by a third party acting on behalf of the controller;
#1409 Article 88a – paragraph 3 – point da (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)
Text proposed by the Commission
Amendment
(da) In Article 88a, paragraph 3, the following point da is added: '(da) carrying out operations to detect, prevent or mitigate fraud and money laundering, as well as to combat the financing of terrorism;'
noyb's comment:
New exception that belongs to national security and would usually be regulated in national law. Allows (but does not oblige) private entities to monitor money laundering through cookies and similar technologies.
#1412 Article 88a – paragraph 3 – point db (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point db (new)
Text proposed by the Commission
Amendment
(db) In Article 88a, paragraph 3, the following point db is added: '(db) performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083.'
#1427 Article 88a – paragraph 4 – point a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point a
Text proposed by the Commission
(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;Amendment
(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner, or be presented with the option to decline consent and proceed to a paid alternative;
#1429 Article 88a – paragraph 4 – point a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point a
Text proposed by the Commission
(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;Amendment
(a) the data subject shall be able to refuse or accept requests for consent in an easy and intelligible manner with a single-click button or equivalent means;
noyb's comment:
Legally establishes that the treatment of the refuse and the accept option are equivalent.
#1431 Article 88a – paragraph 4 – point b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point b
Text proposed by the Commission
(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject;Amendment
(b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully or technically rely on the consent of the data subject;
noyb's comment:
Allows for artificially limiting the period for which consent is technically valid. Then rerequesting is possible.
#1432 Article 88a – paragraph 4 – point c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c
Text proposed by the Commission
(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.Amendment
deleted
#1447 Article 88b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b
Text proposed by the Commission
Article 88bAmendment
deleted
#1452 Article 88b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b
Text proposed by the Commission
Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural personsAmendment
deleted
#1461 Article 88b – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1
Text proposed by the Commission
(1) Controllers shall ensure that their online interfaces allow data subjects to: (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.Amendment
deleted
#1467 Article 88b – paragraph 1 – point a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a
Text proposed by the Commission
(a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;Amendment
deleted
#1473 Article 88b – paragraph 1 – point b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point b
Text proposed by the Commission
(b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.Amendment
deleted
#1489 Article 88b – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 2
Text proposed by the Commission
(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.Amendment
deleted
#1500 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 3
Text proposed by the Commission
(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.Amendment
deleted
noyb's comment:
Broader application for automated signals, less interruptions for users, unique simpler experience for most interfaces. Exception is questionable from an equality before the law perspective.
#1507 Article 88b – paragraph 4 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4
Text proposed by the Commission
(4) The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.Amendment
deleted
#1511 Article 88b – paragraph 4 – first subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph
Text proposed by the Commission
The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices.Amendment
deleted
#1519 Article 88b – paragraph 4 – second subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – second subparagraph
Text proposed by the Commission
Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.Amendment
deleted
#1527 Article 88b – paragraph 5 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 5
Text proposed by the Commission
(5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].Amendment
deleted
noyb's comment:
Can be read as good for privacy (shortening the time for application) or as negative as a part of deleting the article, given that an implementation in 20 days [when the Article would apply] seems too ambitious.
#1533 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 6
Text proposed by the Commission
(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.Amendment
deleted
#1543 Article 88b – paragraph 7 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 7
Text proposed by the Commission
(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].Amendment
deleted
noyb's comment:
Can be read as good for privacy (shortening the time for application) or as negative as a part of deleting the article, given that an implementation in 20 days [when the Article would apply] seems too ambitious.
#1561 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 1
Text proposed by the Commission
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Amendment
Where the processing of personal data is necessary for the interests of the controller, or a third party, in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, including a general-purpose AI model as defined in Article 3, point (63) of Regulation (E) 2024/1689, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of this Regulation except where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child and except where other Union explicitly require consent. The processing of personal data in the context of the development and operation of an AI system may also be based for the performance of a task carried out by public authorities in the public interest pursuant to Article 6, paragraph 1, point (e) and paragraph 2.
#1565 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 1
Text proposed by the Commission
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Amendment
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
noyb's comment:
The amendment removes the option for Member States to require consent.
#1587 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2
Text proposed by the Commission
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.Amendment
Any such processing shall be subject to appropriate organisational, technical and legal measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects.
noyb's comment:
The amendment pushes against the right to object in proposed Article 88c.
#1588 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2
Text proposed by the Commission
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.Amendment
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with a right to object to the processing of their personal data.
noyb's comment:
The amendment pushes against an unconditional right to object.
#1590 Article 88d (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88d (new)
Text proposed by the Commission
Amendment
After Article 88c, the following article is inserted: 'Article 88d Processing in the context of the provision of audiovisual media services of general interest Where the processing of personal data, including the storage of or access to personal data already stored in the terminal equipment of a natural person, is necessary for the delivery and audience measurement of both programmes and advertising provided by audiovisual media services of general interest, as referred to in Article 7a of Directive 2010/13/EU, such processing shall be carried out on the basis of legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679. This shall apply except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data, in particular where the data subject is a child. Any such processing shall be subject to appropriate organisational and technical measures, as well as safeguards to protect the rights and freedoms of the data subject. These measures and safeguards shall be set out in a sectoral code of conduct established in accordance with Article 40(2)(b) of Regulation (EU) 2016/679 and approved pursuant to Article 40(5) thereof.'
noyb's comment:
This amendment proposes further AI allowances for audiovisual media services.