16 GDPR-relevant amendments by Christophe Grudler
#998 Article 6 – paragraph 4 – point d (Article 3 – paragraph 1 – point 2 – point i (new))
Authored by
Regulation (EU) 2016/679
Article 6 – paragraph 4 – point d
Text proposed by the Commission
Amendment
i) In Article 6, paragraph 4, point d is replaced by the following: '(d) the possible consequences of the intended further processing for data subject, in particular where the data subject is a child;'
noyb's comment:
The proposed text includes particular attention for processing in relation to children, however this is (often) read as a factor to argue that the protection is not to be afforedt to adults.
#999 Article 6 – paragraph 1 – subparagraph 3 (Article 3 – paragraph 1 – point 2 – point ii (new))
Authored by
Regulation (EU) 2016/679
Article 6 – paragraph 1 – subparagraph 3
Text proposed by the Commission
Amendment
ii) In Article 6, paragraph 1, the following subparagraph is added: 'The processing of a child’s personal data for advertising purposes and for the creation of personality and user profiles is not permitted.'
noyb's comment:
The proposed amendment is a new clear prohibition of certain processings in relation to children.
#1131 Article 21 – paragraph 1 (Article 3 – paragraph 1 – point 6 a (new))
Authored by
Regulation (EU) 2016/679
Article 21 – paragraph 1
Text proposed by the Commission
Amendment
6a. In Article 21, paragraph 1 is replaced by the following: '1. The data subject shall have the right to object, on grounds relating to his or her particular situation, notably where the data subject is a child, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.'
noyb's comment:
The only introduction is “notably where the data subject is a child”. While it is not completely certain, it could be assumed that this means that the fact that the data subject is a child in itself means that there are grounds relating to their particular situation allowing for an objection. This would increase the level of privacy for children since they don’t have to provide further proof regarding their situation. Since the wording is unclear, this cannot be considered to provide for clear simplification.
#1160 Article 25 – paragraphs 1 and 2 (Article 3 – paragraph 1 – point 7 a (new))
Authored by
Regulation (EU) 2016/679
Article 25 – paragraphs 1 and 2
Text proposed by the Commission
Amendment
7a. In Article 25, paragraph 1 and 2 are replaced by the following: '1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects. In doing so, particular attention shall be paid to the protection of the rights of children. 2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons. The default settings shall take into account, in particular, the vulnerability of children.'
noyb's comment:
Additional emphasis is on the protection of the rights of children - even though it is not quite clear, what this would entail.
#1178 Article 33 – paragraph 1 (Article 3 – paragraph 1 – point 8 – point a)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 1
Text proposed by the Commission
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.Amendment
1. In the case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, in which case particular consideration shall be given to the risk to children, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
noyb's comment:
The proposal basically eliminates the level of data protection lowering changes and even adds a particular consideration of the risks to children – even if it is not quite clear, what this would mean in practice. This means also an increased administrative burden for controllers and supervisory authorities compared to the Commission’s proposal. The amendments regarding the single-entry point are kept from the Commission’s proposal.
#1222 Article 35 – paragraph 1 (Article 3 – paragraph 1 – point 9 – point a a (new))
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 1
Text proposed by the Commission
Amendment
(aa) In Article 35, paragraph 1 is replaced by the following: 1. Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. Where children are affected by the processing, the risks and consequences that the processing may have on their specific rights shall be explicitly addressed. A single assessment may address a set of similar processing operations that present similar risks.
noyb's comment:
This proposal highlights the potential effects on children, providing for an increased level of data protection while the increased legal uncertainty is negligible.
#1234 Article 35 – paragraph 7 – points c and d (Article 3 – paragraph 1 – point 9 – point b a (new))
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 7 – points c and d
Text proposed by the Commission
Amendment
(ba) In paragraph 7 of Article 35, points c and d are replaced by the following: (c) an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1, taking particular account where the personal data of a child is concerned; and (d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned, in particular children.
noyb's comment:
This proposal adds emphasis on children, increasing the level of data protection but providing for some legal uncertainty since it is not clear what this would entail.
#1253 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 1
Text proposed by the Commission
(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.Amendment
(1) The European Data Protection Board (EDPB) shall issue an opinion in accordance with Article 64(2) addressing the application of pseudonymisation and anonymisation, including related technical and organisational measures, to specify the means and criteria to determine whether the application of pseudonymisation and anonymisation to personal data effectively prevents the identification of a data subject and the data subject is not or is no longer identifiable.Justification
Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.
noyb's comment:
Read in conjunction with the following proposals: 1253, 1261, 1262, 1263, 1264, 1266, 1272, 1286, 1295, 1299. This proposal, taken as a whole, is a less radical approach in codifying the EDPS vs SRB judgement (C‑413/23 P) compared to the Commission’s proposal. The key difference is that this proposal takes away the Commission’s power to unilaterally adopt implementing acts (legally binding) and decide which pseudonymised data no longer constitutes personal data. This proposal leaves the decision to the EDPB - via an opinion (not binding legally) - and rather than relying solely on pseudonymisation, it introduces anonymisation as a technique that can (also) effectively prevent the identification of a data subject.
#1261 Article 41a – paragraph 5a (new) (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 5a (new)
Text proposed by the Commission
Amendment
(1a) In Article 41a, the following paragraph 5a is inserted: '5a. The Commission shall encourage and facilitate the drawing up of a code of conduct on the application of pseudonymisation and anonymisation, at Union level in accordance with the procedure planned in Article 40(7), in order to contribute to the proper application of this Regulation.'Justification
Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.
noyb's comment:
Although the proposal seeks to take power away from the Commission that it seeks to afford itself via implementing acts proposed in 41a of the Digital Omnibus, it still stays overall as a decrease of protection for data subjects' fundamental rights.
#1262 Article 41a – paragraph 5b (new) (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 5b (new)
Text proposed by the Commission
Amendment
(1b) In Article 41a, the following paragraph 5b is added: '5b. When preparing a code of conduct on the application of pseudonymisation and anonymisation, in accordance with Article 40(2)(d), due account shall be taken of the European Data Protection Board (EDPB) opinion, as referred to in paragraph 1.'Justification
Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.
noyb's comment:
Read in conjunction with the following proposals: 1253, 1261, 1262, 1263, 1264, 1266, 1272, 1286, 1295, 1299. This proposal, taken as a whole, is a less radical approach in codifying the EDPS vs SRB judgement (C‑413/23 P) compared to the Commission’s proposal. The key difference is that this proposal takes away the Commission’s power to unilaterally adopt implementing acts (legally binding) and decide which pseudonymised data no longer constitutes personal data. This proposal leaves the decision to the EDPB - via an opinion (not binding legally) - and rather than relying solely on pseudonymisation, it introduces anonymisation as a technique that can (also) effectively prevent the identification of a data subject.
#1264 Article 41a – paragraph 2 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2
Text proposed by the Commission
(2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.Amendment
deleted
#1266 Article 41a – paragraph 2 – point a (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
Text proposed by the Commission
(a) assess the state of the art of available techniques;Amendment
deleted
#1272 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
Text proposed by the Commission
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.Amendment
deleted
#1286 Article 41a – paragraph 3 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 3
Text proposed by the Commission
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.Amendment
deleted
#1295 Article 41a – paragraph 4 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 4
Text proposed by the Commission
(4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.Amendment
deleted