80 GDPR-relevant amendments by Markéta Gregorová
#85 Recital 2
Authored by
Text proposed by the Commission
(2) Union digital legislation sets high standard in the Union and can be a powerful source of competitive advantage for businesses that abide by the rules, showing a world-leading mark of quality, safety and trustworthiness. Digital regulations have framed the clear rules of the game in the Union for responsible businesses, ensuring fairness and transparency in business-to-business relations, stimulating innovative business models, setting high standard of consumer protection and safety, and for the protection fundamental rights, not least privacy and data protection.Amendment
(2) Union digital legislation sets high standards in the Union and can be a powerful source of competitive advantage for businesses that abide by the rules, showing a world-leading mark of quality, safety and trustworthiness. Digital regulations have framed the clear rules of the game in the Union for responsible businesses, ensuring fairness and transparency in business-to-business relations, stimulating innovative business models, setting high standard of consumer protection and safety, and for the protection of fundamental rights, not least privacy and data protection.
#90 Recital 3
Authored by
Text proposed by the Commission
(3) Union digital legislation has evolved incrementally over the past years, in response to the rapidly growing footprint of digital technologies in the Union’s economy and societal dynamic, and in view of addressing emerging challenges and promoting business opportunities in the EU. Notwithstanding the Commission’s commitment to a systematic ‘stress test’ of the digital rules, along with other Union rules, which might lead to further regulatory adjustments notably following the forthcoming Digital Fitness Check, as well as other targeted evaluations of digital rules, immediate regulatory changes are necessary. Consequently, this Regulation proposes a first set of amendments to the digital legislative framework, aimed at providing immediate regulatory clarifications that stimulate innovation in the Union market, and that cut administrative compliance costs in particular for businesses, while also streamlining supervisory and administrative costs for supervisory authorities and advisory bodies. The amendments also seek to provide clarity to individuals.Amendment
(3) Union digital legislation has evolved incrementally over the past years, in response to the rapidly growing footprint of digital technologies in the Union’s economy and societal dynamic, and in view of addressing emerging challenges and promoting business opportunities in the EU. The Commission committed to a systematic ‘stress test’ of the digital rules, along with other Union rules. This Regulation proposes a set of amendments to the digital legislative framework, aimed at providing regulatory clarifications that stimulate innovation in the Union market, and that cut administrative compliance costs in particular for businesses, while also streamlining supervisory and administrative costs for supervisory authorities and advisory bodies. The amendments also seek to provide clarity to individuals, by bringing needed simplification on the so-called cookie banners.
#97 Recital 4
Authored by
Text proposed by the Commission
(4) Given the foundational role of data in driving value-creation in the digital economy, and pursuant to the objectives of the Communication for a European Data Union Strategy, the amendments presented in this Regulation to the legislative framework regarding data seek to build a coherent and cohesive regulatory framework for the availability and use of data, streamlining and consolidating the data regulatory framework into only two legal acts, namely Regulations (EU) 2016/6795 and (EU) 2023/28546 of the European Parliament and of the Council, from currently five different applicable acts. The amendments seek to cut unnecessary administrative costs and stimulate the availability of data as a prerequisite for supporting competitive digital businesses in the Union, while maintaining the highest standard of protections for privacy, personal data protection, and fair business practices, and ensuring core regulatory objectives, including compliance with EU and national competition law. _________________ 5 REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) 6 REGULATION (EU) 2023/2854 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act)Amendment
(4) Given the foundational role of data in driving value-creation in the digital economy, and pursuant to the objectives of the Communication for a European Data Union Strategy, the amendments presented in this Regulation to the legislative framework regarding data seek to build a coherent and cohesive regulatory framework for the availability and use of non-personal data, streamlining and consolidating the data regulatory framework into Regulation (EU) 2023/28546 of the European Parliament and of the Council. The amendments seek to cut unnecessary administrative costs and stimulate the availability of data as a prerequisite for supporting competitive digital businesses in the Union, while maintaining the highest standard of protections for privacy, personal data protection, and fair business practices, and ensuring core regulatory objectives, including compliance with EU and national competition law. _________________ 6 REGULATION (EU) 2023/2854 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act)
noyb's comment:
Highlighting that the economic use should be limited to non-personal data. Can have an impact on future interpretation, but no direct impact on the law.
#211 Recital 27
Authored by
Text proposed by the Commission
[...]Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#237 Recital 28
Authored by
Text proposed by the Commission
(28) In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as methodological and systematic approach applied while conducting the research in the specific area. Research and technology development should be conducted in academic, industry and other settings, including small and medium-sized undertakings, (Article 179(2) TFEU) and should be always of a of high quality and should adhere to the principles of principles of reliability, honesty, respect and accountability (verifiability).Amendment
(28) In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as methodological and systematic approach applied while conducting the research in the specific area. Scientific research should be conducted in academic, industry and other settings, including small and medium-sized undertakings, and should be always of a of high quality and should adhere to the principles of principles of reliability, honesty, respect and accountability (verifiability). Transparency may, among other things, involve making research results publicly available, in principle after peer review. The publication of the results also contributes to the aim of contributing to the growth of society’s general knowledge. Scientific research may further a subsequent commercial interest. Processing should not be considered scientific research where its primary purpose is commercial product development, advertising, marketing, profiling, service optimisation, or customer analytics.
noyb's comment:
More criteria to exlude certain problematic processing activities for scientific reserach purposes are added;
#245 Recital 29
Authored by
Text proposed by the Commission
(29) It should be reiterated that further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. In such cases it is not necessary to ascertain on the basis of Article 6(4) of this Regulation whether the purpose of the further processing is compatible with the purpose for which the personal data are initially collected.Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently, as interpreted by EDPB guidelines 1/2026
#256 Recital 30
Authored by
Text proposed by the Commission
(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
deleted
noyb's comment:
This amendment simply proposes to not alter recitals of the GDPR to include AI technologies.
#271 Recital 31
Authored by
Text proposed by the Commission
(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, providing an unconditional right to object to the processing of their personal data, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#288 Recital 32
Authored by
Text proposed by the Commission
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore can be considered compatible with the purpose for which the personal data originally was collected, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Regulation (EU) 2016/679 are met.
noyb's comment:
Unlimited secondary use violated Article 8(2) of the Charter (purpose limitation).
#297 Recital 33
Authored by
Text proposed by the Commission
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#318 Recital 34
Authored by
Text proposed by the Commission
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.Amendment
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should be allowed where the verification of the claimed identity of the data subject is necessary for a one-to-one verification, and suitable safeguards apply to enable the data subject to have sole control of the verification process. Those safeguards should include, inter alia, that the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that the identity confirmation is required by Union or Member State law with suitable and specific measures to safeguard the fundamental rights and the interests of the data subject and there are no less intrusive alternative solutions that could achieve the same objective as effectively. The controller should not gain knowledge of the biometric data or only for a very limited time during the verification process. The biometric data and personal data related to the verification process that is not necessary to retain should therefore be deleted after the verification process, in accordance with the principles established in Regulation (EU) 2016/679.
noyb's comment:
The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 9.
#326 Recital 35
Authored by
Text proposed by the Commission
(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. By contrast, it should be clarified in Article 12 of the Regulation that the right of access, which is from the outset favourable to data subjects, should not be abused in the sense that the data subjects abuse them for purposes other than the protection of their data. For example, such an abuse of the right of access would arise where the data subject intends to cause the controller to refuse an access request, in order to subsequently demand the payment of compensation, potentially under the threat of bringing a claim for damages. Other examples of abuse include situations where data subjects make excessive use of the right of access with the only intent of causing damage or harm to the controller or when an individual makes a request, but at the same time offers to withdraw it in return for some form of benefit from the controller. Moreover, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive conduct of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abuse only to a reasonable level. In any event, while requesting access under Article 15 of Regulation (EU) 2016/679 the data subject should be as specific as possible. Overly broad and undifferentiated requests should also be regarded as excessive.Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#342 Recital 36
Authored by
Text proposed by the Commission
(36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller. These should be the situations where the context of the relationship between the controller and the data subject is very clear and circumscribed and the controller’s activity is not data-intensive, such as the relationship between a craftsman and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment. In such circumstances, that is to say when the processing is non data-intensive, non-complex and where the controller collects a low amount of personal data, it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679. The same should apply to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.Amendment
(36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the personal data have been collected by a micro, small, and medium-sized enterprise or an organisation employing fewer than 250 employees, the personal data are necessary based on point (b) of paragraph 1 of Article 6 in the context of a clear and circumscribed relationship between the data subject and a controller which the data subject fully comprehends and which is not data-intensive, the controller is not required to appoint a data protection officer pursuant to Article 37(1), the personal data are not special categories of data pursuant to Article 9 or personal data related to criminal convictions and offences pursuant to Article 10, there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 and the information remains available to the data subject, the controller does not transmit the data to other controllers or to a third country, the controller does not carry out automated decision-making, including profiling, referred to in Article 22(1) and the processing is not likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35. The context of the relationship between the controller and the data subject is very clear and circumscribed in situations such as the relationship between a craftsman and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The processing could for instance be limited to activities related to bookings, orders or appointments as long as the controller fulfills all the requirements. The personal data needs, however, to be collected by the controller directly from the data subject. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment or profiling. Complex processing operations are outside the scope of this exemption notably as the average data subject would not be in the capacity to comprehend them. In order to assume that the data subject has the information referred to in points (a) and (c) of paragraph 1 of Article 13 Regulation (EU) 2016/679 and the average data subject comprehends the processing, the data needs to be collected directly from the data subject, the processing needs to be non data-intensive, non-complex and the controller needs to collect a low amount of personal data. The information needs, however, to remain available to the data subject through other means, in order to enable the data subject to exercise its rights or check the lawfulness of the processing. That information can either be made available to the public, such as on the website of the controller or it could, for instance in the case of controllers not having a website, be available upon request. The same should apply to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. If the controller aims for more transparency, the controller may alternatively provide the information solely through the icons referred to in Article 12(7) of Regulation (EU) 2016/679, as long as the complete information remains easily and readily available to the data subject through other means. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.
noyb's comment:
This proposal further elaborates on the Commission's proposal regarding an additional exemption from the information obligation in Article 13 GDPR. However, the provision is in particular unworkable for the SMEs which are supposed to be the beneficiaries of the provision.
#355 Recital 37
Authored by
Text proposed by the Commission
(37) Where the processing takes place for the purpose of scientific research and the provision of information to the data subject proves to be impossible or would involve a disproportionate effort it should not be necessary to provide the information provided for under Article 13 of this Regulation. The controller should make reasonable efforts to acquire contact details if they are readily available and acquisition would not require a disproportionate effort. The provision of the information would involve a disproportionate effort in particular where the controller at the time of collection of the personal data did not know or anticipate that it would process personal data for scientific research purposes at a later stage, in which case it may not have easily available contact details of the data subjects. In such situations the controller should inform data subjects indirectly, such as by making the information publicly available. The provision of such information should ensure that as many data subjects concerned as possible are reached. Relevant means to make the information publicly available should be determined depending on the context of the research project and the data subjects involved.Amendment
deleted
noyb's comment:
Pushing back against the extension of the exemption from information obligations in the case of processing for scientific purposes, is positive for the level of data protection since it requires data subjects to be informed about the processing of their data.
#368 Recital 38
Authored by
Text proposed by the Commission
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.Amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. Legal effects and similarly significant effects on the data subject should be interpreted broadly, and include decisions such as payment methods offered to a data subject and prices shown to a data subject when visiting an online retailer. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed only when specific conditions are met, as set out in Regulation (EU) 2016/679 and this Regulation. When several equally effective automated processing solutions exist, the controller should use the less intrusive one. In any case, such processing should be subject to suitable safeguards, which should include specific information to the data subject and the right to obtain meaningful human intervention, to express his or her point of view, to obtain an explanation of the decision reached after such assessment and to challenge the decision. Meaningful human intervention includes that the reviewer should be able to review the accuracy of the data and logic involved in the decision and the consequences of the decision, not merely the output. In other words, the reviewer should be able to review the facts, circumstances and reasons for such decisions. The human reviewer should be provided with appropriate training, have the relevant competence and skills and be empowered to revoke, amend and override the decision. The controller should provide an answer to the request to obtain a meaningful human intervention as fast as possible.
noyb's comment:
Highlighting the broad interpretation of a decision's effect pushes for a higher level of data protection. The same is true for the codification of privacy friendly case law regarding the required meaningfulness of human involvement.
#377 Recital 38 a (new)
Authored by
Text proposed by the Commission
Amendment
(38a) For the purposes of this Regulation and Regulation (EU) 2016/679, free and open-source software, including whether it has been developed or supplied outside the course of a commercial activity, should have the same meaning as defined and further specified in Regulation (EU) 2024/2847.
noyb's comment:
Pure clarification concerning the a term used in the caber reslience act which should have the same meaning under the GDPR..
#382 Recital 39
Authored by
Text proposed by the Commission
(39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches.Amendment
(39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission is empowered to decide that the lists and the template as established by the Board have general validity within the Union by way of an implementing act. In order to take account of new information security threats, the common template and the list should be reviewed and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches. If processing operations do not appear in any of the lists, the controller is still required to assess whether the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.
noyb's comment:
The proposal is built upon the Commission’s proposal but seems to be related to the move of some competences to the EDPB. However, the last sentence provides for some uncertainty (not completely offsetting the Commission’s proposal’s effect), since it is not completely clear, which lists (plural) the proposal refers to. The sentence also seems to provide for no material change to the Commission’s proposal which reduces the level of data protection while providing for some simplification.
#389 Recital 40
Authored by
Text proposed by the Commission
(40) Article 35 of that Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. The lists of processing operations should be prepared by the Board and adopted by the Commission as an implementing act. In order to facilitate compliance by controllers, the Board should also prepare a common template and a common methodology for conducting data protection impact assessments, to be adopted by the Commission as an implementing act. The Commission should take due account of the proposals prepared by the Board and review them, as necessary, prior to adoption. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary.Amendment
(40) Article 35 of that Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. For processing operations that are on none of the lists, the controller is required to assess the need for a data protection impact assessment. The lists of processing operations should be established by the Board, and the Commission is empowered to decide that the lists as established by the Board have general validity within the Union by way of an implementing act. In order to facilitate compliance by controllers, the Board should also establish prepare a common template and a common methodology for conducting data protection impact assessments, and the Commission is empowered to decide that the common template and the common methodology as established by the Board have general validity within the Union by way of an implementing act. In order to take account of technological developments, the lists and the common template and methodology should be reviewed and updated where necessary.
noyb's comment:
This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. It also provides for some clarifications without significant changing the level of data protection or simplification.
#399 Recital 41
Authored by
Text proposed by the Commission
(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council16 applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council17 applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brough into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. _________________ 16 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). 17 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).Amendment
(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council16 applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council17 applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brought into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. _________________ 16 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). 17 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).
#425 Recital 44 – paragraph 1
Authored by
Text proposed by the Commission
The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment and the subsequent processing of such data should be regulated under a single legal framework, namely Regulation (EU) 2016/679, where the subscriber of the electronic communications service or the user of the terminal equipment is a natural person. The amendments presented in this Regulation continue to offer the highest levels of protection for personal data, while simplifying the experiences of data subjects in exerting their rights and expressing their choices online. The amendments concern in particular storage of information in that equipment, accessing or otherwise collecting information from that equipment that entails the processing of personal data through cookies or similar technologies to gain information from the terminal equipment. The relevant rules should also apply regardless of whether the terminal equipment is owned by the natural person or by another legal or natural person.Amendment
The amendments presented in this Regulation regarding the storing of information or the gaining of access to information already stored in a terminal equipment continue to offer the highest levels of protection, while simplifying the experiences of data subjects in exerting their rights and expressing their choices online. The amendments concern in particular storage of information in that equipment, accessing or otherwise collecting information from that equipment that entails inter alia the processing of personal data or other information through cookies or similar technologies to gain information from the terminal equipment. The relevant rules should also apply regardless of whether the terminal equipment is owned by the natural person or by another legal or natural person.
#428 Recital 44 – paragraph 2
Authored by
Text proposed by the Commission
The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment should continue to be allowed only on the basis of consent. Similar to the approach in Directive 2002/58/EC, this requirement should not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, when that is based on Union or Member State law within the meaning of Article 6 of Regulation (EU) 2016/679 and if it fulfils all conditions of lawfulness laid down in that provision, and is done for the objectives laid down in Article 23(1) of Regulation (EU) 2016/679.Amendment
The storing of information, or the gaining of access to information already stored, in a terminal equipment should continue to be allowed only on the basis of consent.
noyb's comment:
Uses the wording of the ePrivacy Directive to clarify the proposal of the Commission.
#442 Recital 44 – paragraph 3
Authored by
Text proposed by the Commission
With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. The controller, such as a media service provider, may mandate a processor, such as a market research company, to carry out the processing on its behalf.Amendment
With a view to reducing the compliance burden and providing legal clarity, and given that certain purposes of storing or gaining access to the information on the terminal equipment of a natural person poses a low risk to the rights and freedoms of data subjects or that it may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. This limited list of low risk operations includes audience measurement, especially in the case of media providers, and the restoration or maintenance of the security of the terminal equipment, provided that service providers fulfill certain conditions. In the case of audience measurement, the data should be instantly anonymised and aggregated. The user’s personal data could, for instance, be retained for a short time session. At the end of the session, the data would be aggregated in such a way that it does not constitute personal data and remaining personal data from the session is deleted or anonymised. The user should still be informed about the storing or gaining access. All of these operations should always be strictly technically and solely necessary for the purpose.
noyb's comment:
Relies on further exceptions to the current legal framework.
#447 Recital 44 – paragraph 4
Authored by
Text proposed by the Commission
For the subsequent processing of personal data for other purpose than those defined in the limitative list, Article 6 and, where relevant, Article 9 of Regulation (EU) 2016/679 should be applied. It is the responsibility of the controller in the light of the principle of accountability to choose the appropriate legal basis for the intended processing. In order to be able to rely on legitimate interest under Article 6(1), point f, of Regulation (EU) 2016/679 as a ground for the subsequent processing of personal data, the controller must show that it pursues the controller’s or third parties’ legitimate interest, the processing is necessary in order to achieve the purpose of that legitimate interest, and the interests or fundamental rights of the data subject do not override the interests pursued by the controller. In this context, controllers should take outmost account of the following elements: whether the data subject is a child; the reasonable expectations of data subject; the impact on the individual either because of the scale of data processed or the sensitivity of the data processed; the scale of the processing at issue in the sense that the processing cannot be particularly extensive either because of their amount or the range of categories of data; the processing should be based on data limited to what is necessary and cannot be based on monitoring of large parts of the online activity of the data subjects; and other relevant factors as appropriate. The processing should not give rise to the continuous monitoring of the data subject’s private life.Amendment
For the subsequent processing of personal data Article 6 and, where relevant, Article 9 of Regulation (EU) 2016/679 should be applied. It is the responsibility of the controller in the light of the principle of accountability to choose the appropriate legal basis for the intended processing.
noyb's comment:
Provides no visible improvement over the current legal situation, is very broad and it remains unclear if it applies in general or to a specific situation.
#456 Recital 44 – paragraph 5
Authored by
Text proposed by the Commission
Where the controller cannot rely on legitimate interest as a legal ground for the subsequent processing, the processing should be based on another ground in Article 6(1), in particular on consent in accordance with Articles 6 and 7 of Regulation (EU) 2016/679, provided that all principles of Regulation (EU) 2016/679 are met.Amendment
deleted
#459 Recital 45
Authored by
Text proposed by the Commission
(45) Data subjects that have refused a request for consent are often confronted with a new request to give consent each time they visit the same controller’s online service again. This may have detrimental effects to the data subjects which may consent just in order to avoid repeating requests. The controller should therefore be obliged to respect the data subject’s choices to refuse a request for consent for at least a certain period.Amendment
(45) Users that have refused a request for consent are often confronted with a new request to give consent each time they visit the same service again. This may have detrimental effects to the data subjects or users which may consent just in order to avoid repeating requests. The controller should therefore be obliged to respect the users’ choices to refuse a request for consent and not ask for consent again where the user has already expressed their choice for the given purpose. For consistency purposes, this Regulation further specifies that the refusal of a request for consent should be as easy as consenting or withdrawing consent, as required under Article 7 of Regulation (EU) 2016/679. The requirements for consent were also strengthened in the case of accessing information already stored or storing information on the terminal equipment of a natural person. Both should be read in conjunction, as the intent is that an option to refuse consent in an easy and intelligible manner is to be provided with a prominently displayed single-click button, especially when there is a possibility to consent to all purposes with a single-click button in the case of Regulation (EU) 2016/679.
noyb's comment:
Improves the Commission proposal that was already positive.
#468 Recital 46
Authored by
Text proposed by the Commission
(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser or in the EU Digital Identity Wallet as set out by Regulation (EU) 914/2014, or any other adequate means. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, media service providers should not be obliged to respect the machine-readable indications of data subject’s choices. The obligation for providers of web browsers to provide the technical means for data subjects to make choices with respect to the processing should not undermine the possibility for media service providers to request consent by data subjects.Amendment
(46) Data subjects and users should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request, withdraw consent or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser, an operating system or an application. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. This is why gatekeepers in the meaning of Regulation (EU) 2022/1925 should allow for third parties to provide for such means and the interface and providers should abide by certain conditions that ensure that no dark patterns are implemented and level playing field is ensured for controllers. Providers should also not be prevented from configuring the technical means to convey a refusal of consent and an exercise of the right to object in such a way that the data subject is not faced with banners, including from the provider. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards or common specifications. Controllers should not make requests for consent for the same purpose through different means if the data subject is using automated and machine-readable signals and they should not override the choices expressed in these signals except if the data subject explicitly requests it.
#482 Recital 47
Authored by
Text proposed by the Commission
(47) Directive 2002/58/EC on privacy and electronic communications ‘ePrivacy Directive’), last revised in 2009, provides a framework for the protection of the right to privacy, including the confidentiality of communications. It also specifies Regulation (EU) 2016/679 in relation to processing of personal data in the context of electronic communication services. It protects the privacy and the integrity of user’s or subscriber’s terminal equipment used for such communications. The current provision of Article 5(3) of Directive 2002/58/EC should remain applicable insofar as the subscriber or user is not a natural person, and the information stored or accessed does not constitute or lead to the processing of personal data.Amendment
(47) Directive 2002/58/EC on privacy and electronic communications ‘ePrivacy Directive’), last revised in 2009, provides a framework for the protection of the right to privacy, including the confidentiality of communications. It also specifies Regulation (EU) 2016/679 in relation to processing of personal data in the context of electronic communication services. It protects the privacy and the integrity of user’s or subscriber’s terminal equipment used for such communications.
noyb's comment:
Unclear if change means that the ePrivacy Directive remains applicable as it is or some other change is intended.
#930 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – second part
Text proposed by the Commission
(a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#968 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38
Text proposed by the Commission
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.Amendment
(38) “scientific research” means research that follows a methodical and systematic approach, adheres to all ethical and other standards in the relevant research field, is able to produce verifiable and transparent results, and is carried out in an autonomous and independent manner with the genuine objective of contributing to the growth of society’s general knowledge.Justification
based on EDPB-EDPS Joint Opinion and EDPB Guidelines 1/2026, section 2.1
#980 Article 4 – point 38a (new) (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38a (new)
Text proposed by the Commission
Amendment
(38a) ‘manufacturer’ means a manufacturer within the meaning of Article 4 of Directive (EU) 2024/2853 of the European Parliament and of the Council.
#983 Article 4 – point 38b (new) (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38b (new)
Text proposed by the Commission
Amendment
(38b) ‘free and open-source software’ means free and open-source software as defined in Article 3(48) of Regulation (EU) 2024/2847.
#995 Article 5 – paragraph 1 – point b (Article 3 – paragraph 1 – point 2)
Authored by
Regulation (EU) 2016/679
Article 5 – paragraph 1 – point b
Text proposed by the Commission
collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);Amendment
collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, (‘purpose limitation’);
noyb's comment:
The amendment reflects EDPB Guidelines 1/2026 and pushes back against the Commission's proposal of additional derogation to Article 6(4).
#1004 Article 7 – paragraph 3 (Article 3 – paragraph 1 – point 2 a (new))
Authored by
Regulation (EU) 2016/679
Article 7 – paragraph 3
Text proposed by the Commission
Amendment
2a. Article 7 paragraph 3 is replaced by the following: '3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to refuse or withdraw consent as to give consent.'
noyb's comment:
Important clarification that codifies a recital from Regulation 2024/900 and is simpler that the suggested Article 88b(4).
#1023 Article 9 – paragraph 2 – point k (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k
Text proposed by the Commission
(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently, as interpreted by EDPB Opinion 28/2024.
#1030 Article 9 – paragraph 2 – point l (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point l
Text proposed by the Commission
(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.Amendment
(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (one-to-one verification), and the following conditions are met: (i) the identity confirmation is required by Union or Member Statea national law providing suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; (ii) the biometric data and the means needed for the verification are under the sole control of the data subject; (iii) the controller can demonstrate that there are no less intrusive alternative solutions that could achieve the same objective as effectively; and (iv) the biometric data is deleted after the verification process has been completed.
noyb's comment:
The amendment improves the Commission's proposal to a point where data subjects are almost as protected as in the current regime.
#1050 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 5
Text proposed by the Commission
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as it currently is.
#1075 Article 12 – paragraph 5 (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5
Text proposed by the Commission
4. In Article 12, paragraph 5 is replaced by the following: ‘5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.’Amendment
deletedJustification
The CJEU was able to decide the "Brillen Rottler" case C-526/24 on the basis of the current wording, no need to introduce new "abuse" or other conditions.
noyb's comment:
With such deletion, the regime stays the same as currently.
#1097 Article 12 – paragraph 8 (Article 3 – paragraph 1 – point 4 a (new))
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 8
Text proposed by the Commission
Amendment
4a. Article 12, paragraph 8 is replaced by the following: '8. The Commission shall adopt delegated acts in accordance with Article 92 for the purpose of determining the information to be presented by the icons and the procedures for providing standardised icons, after consulting the Board. The Commission shall ensure that the icons cover at least the information requirements on the most common purposes and legal bases used by controllers referred to in Article 13(1)(c). Those delegated acts shall apply by [PO to insert: one year after the entry into force].'
noyb's comment:
Standardized icons could improve and simplify the information obligations. So far this is an (unused) option for the Commission.
#1103 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 4
Text proposed by the Commission
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.Amendment
4. Paragraphs 1, 2 and 3 shall not apply where: (a) the data subject already has the information; or (b) the following conditions are met: (i) the personal data have been collected by a micro, small, and medium-sized enterprise or an organisation employing fewer than 250 employees; (ii) the personal data are necessary under point (b) of paragraph 1 of Article 6 in the context of a clear and circumscribed relationship between the data subject and a controller which the data subject fully comprehends and which is not data-intensive; (iii) the controller is not required to appoint a data protection officer pursuant to Article 37(1); (iv) the personal data are not special categories of personal data pursuant to Article 9 or personal data relating to criminal convictions and offences pursuant to Article 10; (v) there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 and the information remains available to the data subject; (vi) the controller does not transmit the data to other controllers, or transfer the data to a third country; (vii) the controller does not carry out automated decision-making, including profiling, referred to in Article 22(1); and (viii) the processing is not likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35. In those cases, the controller may alternatively provide information solely through the icons referred to in Article 12 paragraph 7, as long as the complete information remains easily and readily available to the data subject.
noyb's comment:
Building upon the Commission’s proposal, this amendment similarly allows for further cases where no information to data subjects is provided (even if it tries to incorporate additional safeguards). As does the Com proposal, this provision is overly complex and basically unworkable in practise. A lack of information typcially violates the "fairness" principle in Article 8(2) of the Charter.
#1116 Article 13 – paragraph 5 (Article 3 – paragraph 1 – point 6)
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 5
Text proposed by the Commission
6. In Article 13, paragraph 5 is added: ‘5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.’Amendment
deleted
#1151 Article 22 – paragraph 1 – point a (Article 3 – paragraph 1 – point 7)
Authored by
Regulation (EU) 2016/679
Article 22 – paragraph 1 – point a
Text proposed by the Commission
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means;Amendment
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller;
#1161 Article 22 – paragraph 3 (Article 3 – paragraph 1 – point 7 a (new))
Authored by
Regulation (EU) 2016/679
Article 22 – paragraph 3
Text proposed by the Commission
Amendment
7a. In Article 22, paragraph 3 is replaced by the following: 3. In the cases referred to in points (a) and (c) of paragraph 1, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain meaningful human intervention on the part of the controller, to express his or her point of view and to challenge the decision taken in their regard. Meaningful human intervention, on the part of the controller, requires that the human reviewer reviews the accuracy of the data, the logic involved in the decision and the consequences of the decision, not merely the output of the system. The human reviewer shall have the competence, training and authority necessary to exercise that function, including for overriding automated decisions. The human reviewer shall enjoy protection from dismissal or its equivalent, disciplinary measures and other adverse treatment where they exercise their functions.Justification
Sub-paragraph 3 based on Article 10(2) of the Platform Workers Directive (EU) 2024/2831.
#1171 Article 24 – paragraph 4 (Article 3 – paragraph 1 – point 7 b (new))
Authored by
Regulation (EU) 2016/679
Article 24 – paragraph 4
Text proposed by the Commission
Amendment
7b. In Article 24, paragraph 4 is added: ‘4. The manufacturer shall design and develop its products, services and applications, taking into account the right to the protection of personal data and the state of the art, in such a manner that controllers and processors using those products, services and applications for the processing of personal data are able to comply with their obligations under this Regulation based on the default settings and without having to make disproportionate modifications to those products, services and applications. The manufacturer shall support controllers and processors in fulfilling their obligations under Articles 30, 33 and 34 by providing, upon request, all information necessary for that purpose. This paragraph does not apply to free and open-source software that is developed or supplied outside the course of a commercial activity.‘Justification
Exception for non-commercial free and open-source software from Article 2(2) of the Product Liability Directive (EU) 2024/2853.
noyb's comment:
This amendment introduces a third entity into the data processing relationship between the controllers and processors - the manufacturer - and requires them to provide their services with account for data protection. This is a step in the direction of promoting data protection by design and by default. This would limit the workloads for controllers, as they could rely on GDPR compliant products.
#1186 Article 33 – paragraph 1 (Article 3 – paragraph 1 – point 8 – point a)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 1
Text proposed by the Commission
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.Amendment
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.Justification
NIS2, where the single-entry point is established, also only has 72 hours. One aim of simplification is to have harmonised rules.
noyb's comment:
This proposal keeps the most parts of the Commission’s proposal but strikes the increase in the deadline.
#1195 Article 33 – paragraph 6 (Article 3 – paragraph 1 – point 8 – point c)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 6
Text proposed by the Commission
6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).Amendment
6. By …[PO please insert date: nine months from the entry into application of this amending Regulation] the Board shall establish and make public a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission is empowered to decide that the template and the list have general validity within the Union by way of an implementing act in accordance with the examination procedure set out in Article 93(2).Justification
modeled after Article 40(9) GDPR on the Codes of Conduct
noyb's comment:
This amendment follows some considerations of the EDPB/EDPS opinion and shifts competences to the EDPB.
#1199 Article 33 – paragraph 7 (Article 3 – paragraph 1 – point 8 – point c)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 7
Text proposed by the Commission
7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6.Amendment
7. The template and the list referred to in paragraph 6 shall be reviewed and updated where necessary. The Board shall publish, where necessary, any updates of the template and the list in due time. The Commission is empowered to decide that the updated template and list have general validity within the Union following the procedure in paragraph 6.Justification
modeled after Article 40(9) GDPR on Codes of Conduct
noyb's comment:
Small amendments to the Commission’s proposal regarding the review of lists and templates as well as regarding the Commission’s role in such process. This amendment has little effect on the level of privacy and simplification.
#1206 Article 35 – paragraph 4 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 4
Text proposed by the Commission
4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.Amendment
4. The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.
noyb's comment:
Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.
#1211 Article 35 – paragraph 5 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 5
Text proposed by the Commission
5. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.Amendment
5. The Board shall establish and make public a list of the kind of processing operations for which no data protection impact assessment is required.
noyb's comment:
Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.
#1216 Article 35 – paragraph 5a (new) (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 5a (new)
Text proposed by the Commission
Amendment
5a. In Article 35, the following paragraph is inserted: '5a. For processing operations that are on none of the lists in paragraph 4 and 5, the controller is required to assess the need for a data protection impact assessment.'Justification
To clarify that both lists combined cannot possibly cover the whole universe, but contain the clear edge cases.
noyb's comment:
Clarification that in cases a processing activity is not covered by one of the established lists, the controller has to assess whether a DPIA is necessary. This would be the case also without this clarification.
#1221 Article 35 – paragraphs 6a, 6b, 6c (new) (Article 3 – paragraph 1 – point 9 – point a a (new))
Authored by
Regulation (EU) 2016/679
Article 35 – paragraphs 6a, 6b, 6c (new)
Text proposed by the Commission
Amendment
(aa) In Article 35, the following paragraphs 6a, 6b, 6c are inserted: ‘6a. The lists referred to in paragraphs 4 and 5 and the template and methodology referred to in paragraph 6 shall be published within [PO insert date: 9 months after the entry into application of this amending Regulation]. The Commission is empowered to decide that the lists, the template and the methodology as established by the Board have general validity within the Union by way of implementing acts in accordance with the examination procedure set out in Article 93(2). 6b. The lists and the template and methodology referred to in paragraph 6a shall be reviewed by the Board and updated where necessary. The Commission is empowered to decide that the updated list, template and methodology have general validity within the Union by way of an implementing act following the procedure referred to in paragraph 6a. 6c. Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Board establishes and makes public the lists referred to in paragraphs 4 and 5.’Justification
modeled after Article 40(9) GDPR on Codes of Conduct
noyb's comment:
This proposal provides for some clarification without clear impact on the level of data protection or simplification.
#1247 Article 41a (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a
Text proposed by the Commission
10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#1328 Article 70 – paragraph 1 – point ha (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point ha
Text proposed by the Commission
(ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35.Amendment
(ha) establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and a list of processing operations for which no data protection impact assessment is required, pursuant to Article 35.
noyb's comment:
This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear lists simplify the application of the law.
#1329 Article 70 – paragraph 1 – point hb (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hb
Text proposed by the Commission
(hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.Amendment
(hb) establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.
noyb's comment:
This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.
#1334 Article 70 – paragraph 1 – point hc (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc
Text proposed by the Commission
(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33Amendment
(hc) establish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33
noyb's comment:
This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.
#1343 Article 70 – paragraph 3 (Article 3 – paragraph 1 – point 14 a (new))
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 3
Text proposed by the Commission
Amendment
14a. In Article 70, paragraph 3 is replaced by the following: 3. The Board shall forward its opinions, guidelines, recommendations, common templates, lists, common methodologies and best practices to the Commission and to the committee referred to in Article 93 and make them public.
#1348 Article 79 – paragraph 2 (Article 3 – paragraph 1 – point 14 b (new))
Authored by
Regulation (EU) 2016/679
Article 79 – paragraph 2
Text proposed by the Commission
Amendment
14b. In Article 79, paragraph 2 is replaced with the following: ‘2. Proceedings against a controller, processor or manufacturer shall be brought before the courts of the Member State where the controller, processor or manufacturer has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller, processor or manufacturer is a public authority of a Member State acting in the exercise of its public powers.‘
noyb's comment:
Inclusion of the manufacturer in the GDPR. This overall limits liability for most controllers and also provides for a higher level of protection.
#1351 Article 82 – paragraph 5 (Article 3 – paragraph 1 – point 14 c (new))
Authored by
Regulation (EU) 2016/679
Article 82 – paragraph 5
Text proposed by the Commission
Amendment
14c. In Article 82, paragraph 5 is replaced by the following: '5. Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing of from the manufacturers that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2.'Justification
linked to Article 24(4) (new)
noyb's comment:
The provision adds manufacturers to the parties to seek compensation from. Consistent with other AMs to add "manufacturer".
#1354 Article 82 – paragraph 6a (new) (Article 3 – paragraph 1 – point 14 d (new))
Authored by
Regulation (EU) 2016/679
Article 82 – paragraph 6a (new)
Text proposed by the Commission
Amendment
14d. 14c. In Article 82, the following paragraph 6a is added: ‘6a. Where damage is caused wholly or partly by an act or omission of a manufacturer, the manufacturer shall be liable to the data subject in addition to the controller or processor.’
noyb's comment:
Overall shift to include manufacturers improves the privacy rights of users and shifts responsibilites from most controllers, which leads to overall simplification.
#1355 Article 83 – paragraph 5 – point ea (new) (Article 3 – paragraph 1 – point 14 e (new))
Authored by
Regulation (EU) 2016/679
Article 83 – paragraph 5 – point ea (new)
Text proposed by the Commission
Amendment
14e. In Article 83, paragraph 5, the following point ea is added: '(ea) obligations related to automated and machine-readable signals of data subject’s choices with respect to processing of personal data in the terminal equipment pursuant to Article 88b;'
#1365 Article 88a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a
Text proposed by the Commission
Article 88aAmendment
deleted (The deletion applies to the whole Article 88a.)Justification
Article 88a moved back to the ePrivacy Directive
#1457 Article 88b – title (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – title
Text proposed by the Commission
Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural personsAmendment
Automated and machine-readable signals of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons
#1464 Article 88b – paragraph 1 – chapeau (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – chapeau
Text proposed by the Commission
(1) Controllers shall ensure that their online interfaces allow data subjects to:Amendment
(1) Controllers shall ensure that their online interfaces allow data subjects to signal, through automated and machine-readable means:
#1470 Article 88b – paragraph 1 – point a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a
Text proposed by the Commission
(a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;Amendment
(a) the data subject’s consent for a specific controller and a specified purpose based on actively given consent by them under the conditions for consent laid down in this Regulation;Justification
Consent needs to be informed and can therefore only be given by the data subject themself for the first time.
#1476 Article 88b – paragraph 1 – point b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point b
Text proposed by the Commission
(b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.Amendment
(b) the refusal to give a requested consent and the exercise the right to object pursuant to Article 21(1), Article 21(2), and Article 21(5);Justification
Important to cover all options under Article 21, including the already existing 21(5) on automated exercise of the right to object.
noyb's comment:
Broadens the scope of the right to object, otherwise clarification.
#1482 Article 88b – paragraph 1 – point ba (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point ba (new)
Text proposed by the Commission
Amendment
(ba) In Article 88b, paragraph 1, the following point ba is inserted: '(ba) the withdrawal of consent pursuant to Article 7(3);'
#1493 Article 88b – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 2
Text proposed by the Commission
(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.Amendment
(2) The signals in accordance with paragraph 1 shall be legally valid and be binding on, and enforceable against, the controller and any other party. Controllers shall not make requests for consent for the same purpose through different means. Controllers shall not override the choice made through automated and machine-readable means unless the data subject explicitly requests it.Justification
Wording from the EP mandate on the ePrivacy Reform in 2017
noyb's comment:
Not rerequesting consent through other means is a useful addition that simplifies the situation for everyone involved, as you can rely on automated signals..
#1498 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 3
Text proposed by the Commission
(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.Amendment
deletedJustification
No black/white exemption, but exemption from the need to have consent in the first place in Art. 88a (now moved to ePrivacy) for audience measurement.
noyb's comment:
Broader application for automated signals, less interruptions for users, unique simpler experience for most interfaces. Exception is questionable from an equality before the law perspective.
#1514 Article 88b – paragraph 4 – first subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph
Text proposed by the Commission
The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices.Amendment
By [OP: insert the date: 6 months after entry into force of this amending Regulation], the Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to, within one year after receiving the request, draft standards for the interpretation of machine-readable indications of data subjects’ choices. The standards shall allow for the providers of the technical means and controllers to comply with this Article. When preparing the standardisation request, the Commission shall consult the European Data Protection Board and the European Data Protection Supervisor.
#1522 Article 88b – paragraph 4 – second subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – second subparagraph
Text proposed by the Commission
Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.Amendment
deletedJustification
Moved to new paragraph 4b to also cover common specifications as per 4a.
#1523 Article 88b – paragraph 4a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4a (new)
Text proposed by the Commission
Amendment
(4a) In Article 88b, the following paragraph is inserted: '4a. The Commission shall adopt implementing acts establishing common specifications for the requirements set out in paragraphs 1 and 2, where the following conditions have been fulfilled one year after the request pursuant to paragraph 4 has been made: (a) the request pursuant to paragraph 4 has not been accepted by any of the European standardisation organisations; or (b) the harmonised standards addressing that request are not delivered within the deadline set in paragraph 4 and in accordance with Article 10(1) of Regulation (EU) No 1025/2012; or (c) the harmonised standards do not comply with the request; and (d) no reference to harmonised standards covering the requirements referred to in paragraphs 1 and 2 has been published in the Official Journal of the European Union in accordance with Regulation (EU) No 1025/2012.'Justification
modeled after Article 41 AI Act
#1524 Article 88b – paragraph 4b (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4b (new)
Text proposed by the Commission
Amendment
(4b) In Article 88b, the following paragraph is inserted: '4b. Online interfaces of controllers which are in conformity with harmonised standards or common specifications or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.'Justification
moved here from paragraph 4 last sub-paragraph, so it also covers common specifications as per paragraph 4a (new)
#1529 Article 88b – paragraph 5 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 5
Text proposed by the Commission
(5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].Amendment
(5) Paragraphs 1 and 2 shall apply 12 months following the publication of the standards or the common specifications pursuant to paragraph 4 or 4a.
#1535 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 6
Text proposed by the Commission
(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.Amendment
(6) Providers of web browsers, applications and operating systems shall provide the technical means to allow data subjects to give their consent for specific controllers and specified purposes, to refuse a request for consent, to withdraw consent, and to exercise the right to object through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. Nothing in this paragraph shall preclude a provider of a web browser, an application, or an operating system from configuring the technical means referred to in this paragraph to convey, by default, a refusal of consent and an exercise of the right to object referred to in point (b) of paragraph 1, in line with the requirements of Article 24(4).Justification
Necessary to expand the obligation to any software that allows using information society services.
noyb's comment:
Expands obligation to provide options beyond the Commission proposal.
#1540 Article 88b – paragraph 6a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 6a (new)
Text proposed by the Commission
Amendment
(6a) In Article 88b, the following paragraph is inserted: '6a. Where a provider referred to in paragraph 6 qualifies as a gatekeeper in the meaning of Regulation (EU) 2022/1925, the provider shall enable third-party providers acting structurally and economically independently from it to provide the technical means to convey the data subject's choices referred to in paragraph 1 through the automated and machine-readable means referred to in paragraph 6, as applied pursuant to paragraphs 2 to 5. This paragraph shall not be construed as requiring the provider of a web browser to grant third-party software, including a browser extension, access to data or functionality of the web browser beyond what is necessary to convey to controllers the choices made by data subjects in accordance with paragraph 1.'Justification
Unbundling for browser, app or operating system providers that qualify as gatekeepers under the Digital Markets Act.
#1541 Article 88b – paragraph 6b (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 6b (new)
Text proposed by the Commission
Amendment
(6b) In Article 88b, the following paragraph is inserted: '6b. Providers referred to in paragraph 6, when providing technical means, shall: (a) ensure that conditions laid down in this Article and Article 5(5) of Directive 2002/58/EC are complied with; (b) enable the data subject to pick an option to decline requests for consent, object or withdraw consent for specific purposes or all purposes; (c) enable the data subject to make choices specific to each controller without engaging in any form of differentiated or preferential treatment for specific controllers; (d) not implement practices that materially distort or impair, either on purpose or in effect, the ability of the data subject to make autonomous and informed choices or decisions; (e) ensure that controllers can appropriately inform the data subject in accordance with this Regulation, including on the consequences to decline requests for consent or withdraw consent;'
noyb's comment:
Details the Commission proposal further, contributes to more legal certainty.
#1547 Article 88b – paragraph 7 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 7
Text proposed by the Commission
(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].Amendment
(7) Paragraph 6 shall apply from [OP: please insert the date = 12 months following publication of the standards or the common specifications pursuant to paragraph 4 and 4a].
#1554 Article 88c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c
Text proposed by the Commission
Article 88cAmendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#1713 Article 1 – paragraph 1a (new) (Article 5 – paragraph 1 – point 1 a (new))
Authored by
Directive 2002/58/EC
Article 1 – paragraph 1a (new)
Text proposed by the Commission
Amendment
1a. After Article 5(1), the following paragraph is added: ‘1a. Confidentiality of electronic communications shall also apply to data related to or processed by terminal equipment.”Justification
EP mandate on ePrivacy from 2017
#1720 Article 5 – paragraph 3 (Article 5 – paragraph 1 – point 2 – introductory part)
Authored by
Directive 2002/58/EC
Article 5 – paragraph 3
Text proposed by the Commission
2. After Article 5(3), the following subparagraph is added:Amendment
2. After Article 5(3), the following paragraphs are added:
#1725 Article 5 – paragraph 3a (new) (Article 5 – paragraph 1 – point 2)
Authored by
Directive 2002/58/EC
Article 5 – paragraph 3a (new)
Text proposed by the Commission
This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.Amendment
In Article 5, the following paragraph is added: '3a. Member States shall ensure that the storing of information, or gaining of access to information already stored, in the terminal equipment of a natural person without specific consent, shall be lawful to the extent it is strictly technically and solely necessary for any of the following purpose: (a) carrying out or facilitating the transmission of an electronic communication over an electronic communications network; (b) providing an information society service specifically requested by the natural person; (c) measuring the audience of an information society service explicitly requested by the data subject by creating instantly anonymous aggregated information about the usage of that service, where (i) it is carried out by the provider of that service, or by a processor acting on behalf of this provider, or by an entitled and independent third party performing audience measurement in accordance with Article 24 of Regulation (EU) 2024/1083. This provision does not apply to gatekeepers within the meaning of Regulation (EU) 2022/1925; (ii) it is carried out solely for the provider’s own use and not processed for other purposes; (iii) the data is not combined with data from other services from the provider service, or from a third party, nor shared with a third party except for third parties referred to in point (i); (iv) such measurement does not adversely affect the fundamental rights of the natural person; and (v) the natural person is given a possibility to object; (d) maintaining or restoring the security, confidentiality, integrity, availability and authenticity of the terminal equipment of the user, by means of updates, for the duration necessary for that purpose of a service provided by the controller and explicitly requested by the user or the terminal equipment used for the provision of such service given that (i) such interest is not overridden by the interests or fundamental rights and freedoms of the data subject; (ii) the user is informed about the storing or gaining access and their purpose; (iii) a genuine choice is given to the user to postpone and decide on the automatic nature of such updates, except in the case of a vulnerability presenting a significant cybersecurity risk; and (iv) this does not in any way change the functionality of the hardware or software or the privacy settings chosen by the user; (e) complying with paragraph 4 point c of this Article, without storing personal data including unique identifiers; 5. Member States shall ensure that where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a prominently displayed single-click button; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose; (d) the interface used to request consent shall be presented in a machine-readable format. 6. Member States shall ensure that no user shall be denied access to any information society service or functionality, regardless of whether this service is remunerated or not, on grounds that he or she has not given his or her consent to the processing of personal information and/or the use of processing or storage capabilities of his or her terminal equipment that is not necessary for the provision of that service or functionality. 7. Member States shall ensure that the conditions for giving, refusing or withdrawing consent using automated and machine-readable signals pursuant to Article 88b of Regulation (EU) 2016/679 shall also apply to this Article. 8. This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation].Justification
Article 88a moved back to ePrivacy, in order to avoid that non-personal data is protected better than personal data stored in the terminal equipment.
noyb's comment:
Broader exceptions than the current framework, but more limited than the Commission. In addition, provisions for automated signals and paying with your data is not greenlighted. Overall a mixed AM that cannot be put in one category.