Ivars Ijabs

Text proposed by the Commission

Amendment

(30a) Processing of personal data may be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, including where such processing is carried out by a Member State in relation to military, defence or national security purposes, as referred to in Article 4(2) and 47 of the Treaty on European Union. In accordance with Article 4(2) TEU national security remains the sole responsibility of each Member State. This Regulation should therefore not affect the ability of Member States to carry out processing operations that are necessary for the safeguarding of such essential Member State functions.

noyb's comment:

Highlighting the limtiations of the GDPR. While this can be read as a mere restatement, it can have impact in business-to-governemnt processing situations, that can be covered by the GDPR so far.

#294 Recital 32 a (new)

Authored by

Text proposed by the Commission

Amendment

(32a) The training of AI systems and AI models can constitute a legitimate interest of the controller within the meaning of Article 6(1), point (e), where such training is necessary for the development of AI systems and AI models.

Justification

This amendment clarifies, at the level of general principle in Article 6(1) GDPR, that the training of AI systems and AI models can constitute a legitimate interest of the controller. Embedding this clarification directly in Article 6’s recital provides legal certainty for controllers developing AI systems across the full range of processing activities covered by the GDPR.

noyb's comment:

The amendment proposes to consider training of AI systems and AI models as a processing activity that can be conducted under legitimate interest across the board. This would be more limited thatn the COM proposal, but would still give AI training a clear basis in law, compared to the current GDPR.

#942 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)

Authored by

Regulation (EU) 2016/679
Article 4 – point 1 – second part

Text proposed by the Commission

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

Amendment

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. The parameters of a trained AI model do not constitute personal data where, taking into account the means reasonably likely to be used, a natural person whose personal data was processed during training cannot be identified from the model.

Justification

In line with the case law of the Court of Justice of the European Union (ECLI:EU:C:2025:645), the training of an AI model should not be considered as processing of personal data solely on the ground that its output may contain references to personal data. Such an output constitutes the statistically most probable result generated by the model, rather than the retrieval or reproduction of personal data as such.

noyb's comment:

The amendment includes more derogations than the Commission's proposal.

#963 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 38

Text proposed by the Commission

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.

Amendment

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. The development, training, testing and validation of new technologies, such as AI systems, AI models and AI agents may be topics of scientific research where it meets the conditions of this point.

Justification

Clarifying that the development of new technologies, such as the training of an LLM, may also be considered as scientific research.

noyb's comment:

Suggests that AI trainging is "research", which goes beyond current understanding.

#991 Article 5 – paragraph 1 – point b (Article 3 – paragraph 1 – point 2)

Authored by

Regulation (EU) 2016/679
Article 5 – paragraph 1 – point b

Text proposed by the Commission

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);

Amendment

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or for the development, training, testing, validation or use of new technical solutions based on aggregated data, including AI systems and AI models, subject to the safeguards in Article 88c and without prejudice to Article 9 shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);

Justification

Data collected for one purpose can be reused for research, statistics, archiving, or for training, testing, or using AI systems on data from which individuals are not identifiable, and this reuse is deemed compatible with the original purpose (so no separate legal basis is needed under Art. 6(4)), provided the Article 88c safeguards apply and it doesn't override Article 9 (special category data protections).

noyb's comment:

This amendment proposes a derogation from the purpose limitation principle for AI, which is not in line with Article 8 and 52 of the CFREU.

#1005 Article 6 – paragraph 1 – point e (Article 3 – paragraph 1 – point 2 a (new))

Authored by

Regulation (EU) 2016/679
Article 6 – paragraph 1 – point e

Present text

Article 6, paragraph 1(e)

Amendment

2a. In Article 6, paragraph 1, point e, the following sentence is added: "This is the case, when processing is necessary for the performance of a task carried out by a Member State related to national security (Article 4(2) TEU)."

Justification

It should be made possible for Member State authorities to make use of the necessary personal and non-personal (mixed) datasets if it is used for national security purposes. This amendment is however, not intended to narrow the existing exclusion or invite GDPR oversight of national security processing.

#1011 Article 6 – paragraph 1 – point e – second sentence (Article 3 – paragraph 1 – point 2 b (new))

Authored by

Regulation (EU) 2016/679
Article 6 – paragraph 1 – point e – second sentence

Present text

(e)processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

Amendment

2b. Article 6 paragraph 1, point e, the following point is added: "This is the case, when processing is necessary for the performance of a task carried out by a Member State related to military and defence purposes as mentioned in Article 42 TEU."

Justification

It should be made possible for Member State authorities to make use of the necessary personal and non-personal (mixed) datasets if it is used for military and defence purposes.

noyb's comment:

The amendment includes a derogation in relation to Article 6(1)(e) which is not foreseen in the current regime. Could allow for secondary use of commercial data for military purposes.