60 GDPR-relevant amendments by Pernando Barrena Arza
#215 Recital 27
Authored by
Text proposed by the Commission
(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council15 . The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act. _________________ 15 Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (OJ L, 2025/327, 5.3.2025, ELI: http://data.europa.eu/eli/reg/2025/327/oj)Amendment
(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection.
noyb's comment:
The change pushes back at a very expansionist approach towards the use of 'pseudonymous' data.
#244 Recital 29
Authored by
Text proposed by the Commission
(29) It should be reiterated that further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. In such cases it is not necessary to ascertain on the basis of Article 6(4) of this Regulation whether the purpose of the further processing is compatible with the purpose for which the personal data are initially collected.Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently, as interpreted by EDPB guidelines 1/2026
#253 Recital 30
Authored by
Text proposed by the Commission
(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
deleted
noyb's comment:
This amendment simply proposes to not alter recitals of the GDPR to include AI technologies.
#273 Recital 31
Authored by
Text proposed by the Commission
(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, providing an unconditional right to object to the processing of their personal data, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#281 Recital 32
Authored by
Text proposed by the Commission
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. Processing for scientific research purposes may, where appropriate, rely on a legal basis provided for in Regulation (EU) 2016/679. Where a controller relies on Article 6(1)(f), it must demonstrate, in the specific circumstances of the processing, that the processing is necessary for the legitimate interests pursued and that those interests are not overridden by the interests or fundamental rights and freedoms of the data subject. Ordinary product optimisation, behavioural advertising, engagement optimisation, commercial profiling, customer analytics, or the development, training or optimisation of artificial intelligence systems shall not qualify as scientific research merely because they involve systematic analysis, testing or technical experimentation. This is without prejudice to legitimate public-interest, qualitative, critical, civil society or participatory research, where carried out according to recognised methodological and ethical standards and subject to appropriate safeguards under Article 89(1). This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.
#299 Recital 33
Authored by
Text proposed by the Commission
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#312 Recital 34
Authored by
Text proposed by the Commission
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.Amendment
deleted
#329 Recital 35
Authored by
Text proposed by the Commission
(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. By contrast, it should be clarified in Article 12 of the Regulation that the right of access, which is from the outset favourable to data subjects, should not be abused in the sense that the data subjects abuse them for purposes other than the protection of their data. For example, such an abuse of the right of access would arise where the data subject intends to cause the controller to refuse an access request, in order to subsequently demand the payment of compensation, potentially under the threat of bringing a claim for damages. Other examples of abuse include situations where data subjects make excessive use of the right of access with the only intent of causing damage or harm to the controller or when an individual makes a request, but at the same time offers to withdraw it in return for some form of benefit from the controller. Moreover, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive conduct of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abuse only to a reasonable level. In any event, while requesting access under Article 15 of Regulation (EU) 2016/679 the data subject should be as specific as possible. Overly broad and undifferentiated requests should also be regarded as excessive.Amendment
(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether personal data concerning them are being processed and, where that is the case, access to the personal data and certain additional information. The right of access allows the data subject to be aware of, and to verify, the lawfulness of the processing and enables the exercise of other rights under Regulation (EU) 2016/679. It may also enable the exercise of other fundamental rights, consumer protection rights, employment rights, rights to non-discrimination, rights of defence, or other legitimate public-interest aims, including research, journalism, collective redress, regulatory oversight or civil society monitoring. The fact that an access request may serve such purposes should not, in itself, make the request manifestly unfounded or excessive. A request should not be considered excessive merely because it concerns a long period of time, complex processing, profiling, automated decision-making, multiple recipients or categories of recipients, or possible systemic rights concerns. The controller should bear the burden of demonstrating the manifestly unfounded or excessive character of the request.
noyb's comment:
The amendment reinforces the importance and broad scope of the right to access.
#336 Recital 36
Authored by
Text proposed by the Commission
[...]Amendment
deleted
noyb's comment:
Deletion of Commission's proposal regarding an additional exemption from the information requirement in Art 13.
#353 Recital 37
Authored by
Text proposed by the Commission
(37) Where the processing takes place for the purpose of scientific research and the provision of information to the data subject proves to be impossible or would involve a disproportionate effort it should not be necessary to provide the information provided for under Article 13 of this Regulation. The controller should make reasonable efforts to acquire contact details if they are readily available and acquisition would not require a disproportionate effort. The provision of the information would involve a disproportionate effort in particular where the controller at the time of collection of the personal data did not know or anticipate that it would process personal data for scientific research purposes at a later stage, in which case it may not have easily available contact details of the data subjects. In such situations the controller should inform data subjects indirectly, such as by making the information publicly available. The provision of such information should ensure that as many data subjects concerned as possible are reached. Relevant means to make the information publicly available should be determined depending on the context of the research project and the data subjects involved.Amendment
deleted
noyb's comment:
Pushing back against the extension of the exemption from information obligations in the case of processing for scientific purposes, is positive for the level of data protection since it requires data subjects to be informed about the processing of their data.
#360 Recital 38
Authored by
Text proposed by the Commission
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.Amendment
deleted
#362 Recital 38
Authored by
Text proposed by the Commission
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.Amendment
(38) Article 22 of Regulation (EU) 2016/679 provides an important safeguard against automated individual decision-making, including profiling, which produces legal effects concerning a data subject or similarly significantly affects them. In order to preserve the effectiveness of that safeguard, the necessity ground in Article 22(2), point (a), should be interpreted strictly. A decision should not be considered necessary for entering into, or performance of, a contract merely because it is useful, efficient, economically advantageous, scalable, faster, more consistent, part of the controller’s business model, or capable of reducing costs. Commercial convenience, service optimisation, fraud prevention at scale, profiling, risk scoring, behavioural prediction or personalised pricing should not, in themselves, constitute necessity. Where automated processing determines or materially determines the outcome of a decision, Article 22 should apply even where a human formally validates, confirms, implements or communicates the outcome. Human involvement should not be used to circumvent Article 22 where it does not include a genuine assessment of the individual case and the authority to change the outcome. Human intervention should be meaningful and carried out by a person with adequate competence, time, information, resources and authority to assess the individual case and modify, reverse or otherwise change the decision. Data subjects should receive meaningful information about the main reasons for the decision, including the main categories of personal data relied upon, the use of profiling or inferred data, the key parameters, factors or criteria that materially influenced the decision, and, where relevant, their relative importance. Such information should be sufficiently specific to allow the data subject to understand why the decision was taken in their individual case and to exercise their rights effectively. Trade secrets, intellectual property or security considerations should not be used to refuse information that is necessary to understand the main reasons for the decision, without prejudice to proportionate measures to protect confidential information. Where a controller relies on contractual necessity under Article 22(2), point (a), the controller should assess whether the same specific contractual purpose can reasonably be achieved through less intrusive means, including human-led, human-reviewed or non-automated alternatives. Where Article 35 applies, that assessment should form part of the data protection impact assessment. The existence of a data protection impact assessment should not, in itself, demonstrate that a decision is necessary within the meaning of Article 22(2), point (a).’
noyb's comment:
Amendment of the Commission's proposal to a version that highlights the potential impact of ADM, the need for relevant human intervention and and highlights privacy friendly case law.
#376 Recital 38 a (new)
Authored by
Text proposed by the Commission
Amendment
(38a) Controllers employing large-scale automated individual decision-making systems, such as automatic rejections or terminations of contracts or accounts, credit scoring or hiring decisions benefit from more efficient procedures, but should also ensure compliance of these systems. Therefore, all automated individual decision-making systems affecting a relevant number of individuals should be subject to a data protection impact assessment and should be demonstratable based scientifically recognised mathematical and statistical methods.
noyb's comment:
This proposal highlights the potential impact of large-scale automated individual decision-making and requires the performance of DPIAs. This increases the level of privacy. While the clarification when a DPIA is necessary reduces complexity, the increased paperwork required increases the administrative burden for controllers.
#383 Recital 39
Authored by
Text proposed by the Commission
(39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches.Amendment
(39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be increased to situations in which a personal data breach is likely to result in an increased risk to the rights and freedoms of natural persons. Since all processing of personal data is connected with some inherent risk, an increased threshold is necessary in order to avoid that every single personal data breach leads to a notification obligation. In order to assess the impact of the data breach to the rights and freedoms of data subjects, the controller shall compare the level of risk prior to the data breach with the respective risk after the data breach. The risk should be considered increased if an existing risk is more likely to materialise or if a new risk emerged by the personal data breach. In the case of a data breach that is not likely to result in an increased risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The threshold for a notification of the supervisory authority about a personal data breach should be lower than the threshold for the obligation to communicate the personal data breach to the affected data subject. Therefore, not all personal data breaches notified to the supervisory authority also result in an obligation to communicate the personal data breach to the affected data subject.
noyb's comment:
This proposal still increases the threshold for the controller’s notification obligation (providing for simplification and lessening its administrative burden as well as the workload for supervisory authorities) but not to the level of the obligation to communicate the breach to data subjects. While this is privacy friendlier than the Commission’s proposal, it still slightly decreases the level of data protection.
#395 Recital 41
Authored by
Text proposed by the Commission
(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council16 applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council17 applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brough into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. _________________ 16 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). 17 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).Amendment
(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council16 applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Regulation (EU) 2018/1725 should be brough into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. _________________ 16 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj).
noyb's comment:
Deleting the reference to the Law Enforcement Directive when requiring that the GDPR should be brought in alignment with other acts. No direct effect.
#422 Recital 44 – paragraph 1
Authored by
Text proposed by the Commission
The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment and the subsequent processing of such data should be regulated under a single legal framework, namely Regulation (EU) 2016/679, where the subscriber of the electronic communications service or the user of the terminal equipment is a natural person. The amendments presented in this Regulation continue to offer the highest levels of protection for personal data, while simplifying the experiences of data subjects in exerting their rights and expressing their choices online. The amendments concern in particular storage of information in that equipment, accessing or otherwise collecting information from that equipment that entails the processing of personal data through cookies or similar technologies to gain information from the terminal equipment. The relevant rules should also apply regardless of whether the terminal equipment is owned by the natural person or by another legal or natural person.Amendment
deleted
#431 Recital 44 – paragraph 2
Authored by
Text proposed by the Commission
The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment should continue to be allowed only on the basis of consent. Similar to the approach in Directive 2002/58/EC, this requirement should not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, when that is based on Union or Member State law within the meaning of Article 6 of Regulation (EU) 2016/679 and if it fulfils all conditions of lawfulness laid down in that provision, and is done for the objectives laid down in Article 23(1) of Regulation (EU) 2016/679.Amendment
The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment should continue to be allowed only on the basis of consent. This requirement should not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, under certain conditions.
noyb's comment:
No legal certainty, plus supports the unworkable divide introduced by the Commission.
#437 Recital 44 – paragraph 3
Authored by
Text proposed by the Commission
With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. The controller, such as a media service provider, may mandate a processor, such as a market research company, to carry out the processing on its behalf.Amendment
deleted
noyb's comment:
Deletes amendment regarding more exceptions to tracking users.
#445 Recital 44 – paragraph 4
Authored by
Text proposed by the Commission
For the subsequent processing of personal data for other purpose than those defined in the limitative list, Article 6 and, where relevant, Article 9 of Regulation (EU) 2016/679 should be applied. It is the responsibility of the controller in the light of the principle of accountability to choose the appropriate legal basis for the intended processing. In order to be able to rely on legitimate interest under Article 6(1), point f, of Regulation (EU) 2016/679 as a ground for the subsequent processing of personal data, the controller must show that it pursues the controller’s or third parties’ legitimate interest, the processing is necessary in order to achieve the purpose of that legitimate interest, and the interests or fundamental rights of the data subject do not override the interests pursued by the controller. In this context, controllers should take outmost account of the following elements: whether the data subject is a child; the reasonable expectations of data subject; the impact on the individual either because of the scale of data processed or the sensitivity of the data processed; the scale of the processing at issue in the sense that the processing cannot be particularly extensive either because of their amount or the range of categories of data; the processing should be based on data limited to what is necessary and cannot be based on monitoring of large parts of the online activity of the data subjects; and other relevant factors as appropriate. The processing should not give rise to the continuous monitoring of the data subject’s private life.Amendment
deleted
noyb's comment:
Pushes back on the Commission, but provides no significant improvement over the current legal situation.
#454 Recital 44 – paragraph 5
Authored by
Text proposed by the Commission
Where the controller cannot rely on legitimate interest as a legal ground for the subsequent processing, the processing should be based on another ground in Article 6(1), in particular on consent in accordance with Articles 6 and 7 of Regulation (EU) 2016/679, provided that all principles of Regulation (EU) 2016/679 are met.Amendment
deleted
#471 Recital 46
Authored by
Text proposed by the Commission
(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser or in the EU Digital Identity Wallet as set out by Regulation (EU) 914/2014, or any other adequate means. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, media service providers should not be obliged to respect the machine-readable indications of data subject’s choices. The obligation for providers of web browsers to provide the technical means for data subjects to make choices with respect to the processing should not undermine the possibility for media service providers to request consent by data subjects.Amendment
(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art and Regulation (EU) 2016/679 by including specific consent per controller as well as withdrawal and objections. They can for example be implemented in the settings of a web browser or in the EU Digital Identity Wallet as set out by Regulation (EU) 914/2014, or any other adequate means in other technological contexts. Rules set out in this Regulation should support the emergence of market-driven third-party solutions with appropriate interfaces. Such solutions shall be neutral and not have any commercial interest in gaining consent from data subjects. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. This includes automated responses by the data subject, when a software responds according to the wishes of the data subject, but without individual actions by the data subject. The mere fact that choices are made on behalf of the data subject in an automated way shall not be used by controllers to claim that these choices are not valid.
#484 Recital 47
Authored by
Text proposed by the Commission
(47) Directive 2002/58/EC on privacy and electronic communications ‘ePrivacy Directive’), last revised in 2009, provides a framework for the protection of the right to privacy, including the confidentiality of communications. It also specifies Regulation (EU) 2016/679 in relation to processing of personal data in the context of electronic communication services. It protects the privacy and the integrity of user’s or subscriber’s terminal equipment used for such communications. The current provision of Article 5(3) of Directive 2002/58/EC should remain applicable insofar as the subscriber or user is not a natural person, and the information stored or accessed does not constitute or lead to the processing of personal data.Amendment
(47) Directive 2002/58/EC on privacy and electronic communications ‘ePrivacy Directive’), last revised in 2009, provides a framework for the protection of the right to privacy, including the confidentiality of communications. It also specifies Regulation (EU) 2016/679 in relation to processing of personal data in the context of electronic communication services. It protects the privacy and the integrity of user’s or subscriber’s terminal equipment used for such communications. The current provision of Article 5(3) of Directive 2002/58/EC should remain applicable.
noyb's comment:
Relies on the current model instead that provides more legal security than the Commission proposal.
#929 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – second part
Text proposed by the Commission
(a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#960 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2026/679
Article 4 – point 38
Text proposed by the Commission
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.Amendment
deleted
#990 Article 5 – paragraph 1 – point b (Article 3 – paragraph 1 – point 2)
Authored by
Regulation (EU) 2026/679
Article 5 – paragraph 1 – point b
Text proposed by the Commission
2. Article 5 (1)(b) is replaced by the following: ‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);’Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently, as interpreted by EDPB guidelines 1/2026
#1002 Article 7 – paragraph 2 (Article 3 – paragraph 1 – point 2 a (new))
Authored by
Regulation (EU) 2016/679
Article 7 – paragraph 2
Text proposed by the Commission
Amendment
2a. In Article 7, paragraph 2 is replaced by the following: " (2) If the data subject’s consent is given in the context of a written declaration or a digital interface which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable for each purpose and from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding. "Justification
Amendment to make Article 7(2) more tech neutral and reflect the need for specific consent.
#1007 Article 7 – paragraph 4 (Article 3 – paragraph 1 – point 2 b (new))
Authored by
Regulation (EU) 2016/679
Article 7 – paragraph 4
Text proposed by the Commission
Amendment
2b. In Article 7, paragraph 4 is replaced by the following: '4. When assessing whether consent is freely given and personal data is processed fairly, utmost account shall be taken of whether, inter alia: (a) the controller has presented all options in a neutral and fair way without highlighting or otherwise prioritizing the option to consent; (b) the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract, is given or refused; or (c) the controller has employed designs, choice options, biased texts or other tactics with the aim of achieving consent, when this deviates from the genuine wishes of data subjects.'Justification
Clarifications to limit the use of dark patterns.
noyb's comment:
Clearer rules for deceptive designs and concepts like "fairness".
#1021 Article 9 – paragraph 2 –point k (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 –point k
Text proposed by the Commission
(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently, as interpreted by EDPB Opinion 28/2024.
#1029 Article 9 – paragraph 2 – point l (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point l
Text proposed by the Commission
(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#1068 Article 12 – paragraph 2 (Article 3 – paragraph 1 – point 3 a (new))
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 2
Text proposed by the Commission
Amendment
3a. In Article 12, paragraph 2 is replaced by the following: 2. The controller shall facilitate the exercise of data subject rights under Articles 15 to 22 of this Regulation. The controller cannot require them to exercise their rights by particular means or limit their rights by offering restrictive online tools that do not allow to request all information under Article 15(1) to (3). In any case, the controller has to provide and publicly disclose an electronic-mail address which allows data subjects to send requests electronically. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject.Justification
It is up to data subjects how they exercise their rights under the GDPR. They are not bound by any form requirements. Similarly, the controller cannot require data subjects to use a particular form or medium to exercise their rights. This fact should be clarified while it should be required from controllers that they designate an email-address for data subjects who want to electronically exercise their rights. Controllers might also provide online-forms but they should still provide the alternative way of submitting an E-Mail.
noyb's comment:
Clarification on practices that are already unlawful under the GDPR.
#1080 Article 12 – paragraph 5 (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2026/679
Article 12 – paragraph 5
Text proposed by the Commission
Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either:Amendment
Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character the controller may refuse to act on the request.
noyb's comment:
The amendment restrains the right to access by removing the possibility for the data subject to pay a reasonnable fee.
#1082 Article 12 – paragraph 5 – point a (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5 – point a
Text proposed by the Commission
(a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; orAmendment
deleted
noyb's comment:
The amendment restrains the right to access by removing the possibility for the data subject to pay a reasonnable fee.
#1086 Article 12 – paragraph 5 – point b (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5 – point b
Text proposed by the Commission
(b) refuse to act on the request.Amendment
deleted
#1093 Article 12 – paragraph 5 – last subparagraph (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2026/679
Article 12 – paragraph 5 – last subparagraph
Text proposed by the Commission
The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.Amendment
The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request. A request shall not be considered manifestly unfounded or excessive solely because it is broad in scope, concerns a long period of time, relates to complex processing operations, concerns profiling or automated decision-making, concerns several recipients or categories of recipients, concerns possible systemic rights issues, or is made for the purpose of exercising rights under this Regulation or other rights, including consumer protection rights, employment rights, rights to non-discrimination, rights of defence, collective redress, research, journalism, regulatory oversight or civil society monitoring. The manifestly unfounded or excessive character of a request shall be assessed restrictively and on the basis of objective and documented circumstances. It shall not be inferred from the purpose of exercising rights, the use of a representative, the use of standardised requests, the scale or complexity of the processing, or the fact that compliance may require a significant effort by the controller.
noyb's comment:
The amendment highlights the broad scope of the right to access and codifies CJEU C-526/24 Brillen Rottler.
#1104 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 4
Text proposed by the Commission
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.Amendment
4. Paragraphs 1, 2 and 3 shall apply only where and insofar as the controller can demonstrate that the data subject already has the information referred to in points (a) and (c) of paragraph 1 and, where the processing is based on point (f) of Article 6(1), the information referred to in point (d) of paragraph 1, in a concise, transparent, intelligible and easily accessible form. This exemption shall apply only where the personal data are collected in the context of a direct, ongoing and clearly circumscribed relationship between the data subject and the controller, for purposes that are strictly connected to and reasonably expected in that relationship, and where the processing is not likely to result in a high risk to the rights and freedoms of data subjects, nor involve complex processing operations, systematic monitoring, profiling, the processing of large amounts of personal data, special categories of personal data, or personal data relating to criminal convictions and offences. The controller shall make the information referred to in paragraphs 1, 2 and 3 available to the data subject in an easily accessible and durable form at the time of collection and shall document the assessment under this paragraph. The first, second and third subparagraphs shall not apply where the controller intends to process the data collected from the data subject for other purposes, transmits the data to other recipients or categories of recipients, transfers the data to a third country or to an international organisation, combines the data with personal data obtained from other sources, processes the data for direct marketing purposes, carries out automated decision-making, including profiling, referred to in Article 22(1), or where the processing requires a data protection impact assessment under Article 35 or is otherwise likely to result in a high risk to the rights and freedoms of data subjects.
noyb's comment:
While the first subparagraph should apparently should provide the basis for an exemption, it says that the information obligation only applies if data subjects already have the information. Might be an editorial mistake. Also, (in case the exemption applies?) the information should be made available to the data subject at the time of collection which also seems not fitting the provision. Technically, as it is, the proposal would decrease the level of privacy while providing legal uncertainty. A lack of information typcially violates the "fairness" principle in Article 8(2) of the Charter.
#1118 Article 13 – paragraph 5 (Article 3 – paragraph 1 – point 6)
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 5
Text proposed by the Commission
6. In Article 13, paragraph 5 is added: ‘5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.’Amendment
deleted
#1139 Article 22 (Article 3 – paragraph 1 – point 7 – introductory part)
Authored by
Regulation (EU) 2016/679
Article 22
Text proposed by the Commission
7. In Article 22, paragraphs 1 and 2 are replaced by the following:Amendment
7. Article 22 is replaced by the following:
#1142 Article 22 (Article 3 – paragraph 1 – point 7)
Authored by
Regulation (EU) 2016/679
Article 22
Text proposed by the Commission
1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision:Amendment
1. Article 22 shall be replaced by the following: The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. A decision shall be considered to be based solely on automated processing where automated processing materially determines the outcome and any human involvement is merely formal, symbolic, limited to validation, or does not include a genuine assessment of the individual case. 2. Paragraph 1 shall not apply only where the decision: (a) is strictly necessary for entering into, or performance of, a contract between the data subject and the controller, and no less intrusive means reasonably available to the controller can achieve the same specific contractual purpose; (b) is authorised by Union or Member State law to which the controller is subject, which respects the essence of the rights and freedoms of the data subject, is necessary and proportionate in a democratic society, and lays down suitable and specific measures to safeguard the data subject’s rights and freedoms and legitimate interests; or (c) is based on the data subject’s explicit consent. For the purposes of point (a), a decision shall not be considered strictly necessary merely because it is useful, efficient, economically advantageous, scalable, faster, more consistent, part of the controller’s business model, or capable of reducing costs. Commercial convenience, service optimisation, fraud prevention at scale, profiling, risk scoring, behavioural prediction or personalised pricing shall not, in themselves, constitute necessity. 3. In the cases referred to in paragraph 2, points (a) and (c), the controller shall implement suitable and specific measures to safeguard the data subject’s rights and freedoms and legitimate interests, including at least: (a) the right to obtain meaningful human intervention on the part of the controller; (b) the right to express their point of view before, or where this is not possible, without undue delay after, the decision is taken; (c) the right to receive meaningful information about the main reasons for the decision, including the main categories of personal data relied upon, the use of profiling or inferred data, the key parameters, factors or criteria that materially influenced the decision, and, where relevant, their relative importance, as well as the steps available to correct inaccurate data, express their point of view and contest the decision; (d) the right to contest the decision and obtain a fresh assessment by a human reviewer. Human intervention shall be carried out by a person with the competence, information, time, resources and authority necessary to assess the individual case and to modify, reverse or otherwise change the decision. The human reviewer shall actively assess the relevant facts and shall not merely rely on, confirm or reproduce the output of the automated system. Information provided pursuant to point (c) shall be sufficiently specific to allow the data subject to understand why the decision was taken in their individual case and to exercise their rights effectively. Controllers shall not rely on trade secrets, intellectual property or security considerations to refuse information that is necessary to understand the main reasons for the decision, without prejudice to proportionate measures to protect confidential information. 4. Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless Article 9(2), point (a) or point (g), applies and suitable and specific measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place. 5. The controller shall document the assessment referred to in paragraph 2, point (a), the less intrusive means considered, including human-led or human-reviewed alternatives, and the measures implemented pursuant to paragraph 3. That documentation shall include the reasons why the decision is strictly necessary, the less intrusive alternatives considered, the organisation of human review, the competence and authority of reviewers, the information made available to them, and the number and proportion of decisions modified, reversed or otherwise changed following human intervention. Where the processing is subject to a data protection impact assessment pursuant to Article 35, that assessment shall include an assessment of whether the same specific purpose can reasonably be achieved through less intrusive means, including human-led, human-reviewed or non-automated alternatives, and an assessment of the risks created by automation, profiling, inferred data and the organisation of human review. The documentation shall be made available to the supervisory authority upon request. Where necessary to verify compliance with this Article, the supervisory authority may require access to relevant testing documentation, evaluation results and controlled testing environments, subject to appropriate confidentiality safeguards.
noyb's comment:
Privacy friendly amendments. But also includes additional documentation and reporting obligations.
#1166 Article 22 – paragraph 4a (new) (Article 3 – paragraph 1 – point 7 a (new))
Authored by
Regulation (EU) 2016/679
Article 22 – paragraph 4a (new)
Text proposed by the Commission
Amendment
7a. In Article 22, the following paragraph 4a is added: '4a. Without any prejudice to Article 35, any automated decision making under Article 22(1) of this Regulation that is likely to affect more than 100 data subjects per year shall be subject to a data protection impact assessment performed by the controller.'Justification
Automated individual decision-making under Article 22 GDPR will regularly trigger the obligation to perform a data protection impact assessment under Article 35 GDPR. However, this provision should introduce relatively hard factors triggering this obligation in cases of large-scale processing and processing of sensitive data in order to avoid situations in which a controller considers the requirements under Article 35 not to be met.
noyb's comment:
This would lead to additional protections, but also additional workloads.
#1172 Article 22 – paragraph 4a (new) (Article 3 – paragraph 1 – point 7 b (new))
Authored by
Regulation (EU) 2016/679
Article 22 – paragraph 4a (new)
Text proposed by the Commission
Amendment
7b. In Article 22, the following paragraph 4a is added: '4a. For any processing operation that is likely to entail automated individual decision making affecting and the profiling of more than 1000 data subjects per year, the controller must be able to demonstrate that the methodology used for the profiling and decision making are based on scientifically recognised mathematical and statistical methods and do not cause any unlawful discrimination. Information demonstrating these facts must be made publicly available by the controller.'Justification
In order to ensure that the automated individual decision-making affecting vast amounts of data subjects is compatible with the principle of fairness, controllers should be obliged to demonstrate that the methodologies used are based on scientifically recognised mathematical and statistical methods and non-discriminatory.
noyb's comment:
Overall improvement, even if there would be an (unintendend) understanding that smaller controllers could engage in the prohibited behaviour.
#1184 Article 33 – paragraph 1 (Article 3 – paragraph 1 – point 8 – point a)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 1
Text proposed by the Commission
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.Amendment
1. In the case of a personal data breach that is likely to result in an increased risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.Justification
The threshold for the obligation to notify the supervisory authority should be lower that the threshold to communicate a personal data breach to the data subject, since controllers generally are incentivised to avoid the communication of a personal data breach to the affected data subject. This tendency to avoid such communication could influence the respective assessment by the controller. While it makes sense to increase the threshold and avoid that supervisory authorities are swamped with personal data breach notifications regarding every incident, it is important that the supervisory authority is informed about the more severe incidents and can also re-asses the controllers risk assessment. In such cases, the supervisory authority could require the controller to communicate the personal data breach to the affected data subjects even if the controller’s initial assessment result in no high risk. This process is stipulated in Article 33(4) GDPR which would basically lose its purpose in case the threshold of Article 33 (notification of a personal data breach to the supervisory authority) would be increased to the threshold of Article 34 GDPR (communication of a personal data breach to the data subjects).
noyb's comment:
This proposal still increases the threshold for the controller’s notification obligation (providing for simplification and lessening its administrative burden as well as the workload for supervisory authorities) but not to the level of the obligation to communicate the breach to data subjects. While this is privacy friendlier than the Commission’s proposal, it still slightly decreases the level of data protection.
#1203 Article 35 – paragraph 4 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 4
Text proposed by the Commission
4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.Amendment
4. By … [nine months from the entry into application of this amending Regulation], the Board shall establish and make public: (a) a Union-level list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1; (b) a Union-level list of the kind of processing operations for which no data protection impact assessment is required; (c) a common template and a common methodology for conducting data protection impact assessments. The lists referred to in points (a) and (b) shall support the consistent application of this Regulation and shall not prevent supervisory authorities from establishing and making public additional lists of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1, where such processing operations are likely to result in a high risk in the context of the Member State concerned.
noyb's comment:
This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. It also provides for an additional list and a template which would result in increased legal certainty.
#1227 Article 35 – paragraph 6 (Article 3 – paragraph 1 – point 9 – point b)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 6
Text proposed by the Commission
6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).Amendment
6a. The Commission may adopt the common template established by the Board pursuant to paragraph 4, point (c), by way of an implementing act in accordance with the examination procedure set out in Article 93(2). The Commission shall not modify the substance of the common methodology or of the lists established by the Board pursuant to paragraph 4, points (a) and (b).
noyb's comment:
This amendment seems to be related to an amendment shifting competences to the EDPB. This has no significant impact on the level of privacy or simplification.
#1246 Article 41a (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a
Text proposed by the Commission
10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#1324 Article 70 – paragraph 1 – point h (Article 3 – paragraph 1 – point 13)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point h
Text proposed by the Commission
13. In Article 70(1), point (h) is deleted.Amendment
deleted
noyb's comment:
This amendment is probably related to a separate deletion of the Commission’s proposal regarding the establishment of black-lists regarding data breaches. On its own, this amendment has no significant impact.
#1325 Article 70 – paragraph 1 – points ha, hb, hc (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – points ha, hb, hc
Text proposed by the Commission
14. In Article 70(1), the following points are inserted: ‘(ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35. (hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35. (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33’Amendment
deleted
noyb's comment:
This amendment is probably related to a separate deletion of the Commission’s proposal regarding the establishment of black-lists regarding data breaches. On its own, this amendment has no significant impact.
#1346 Article 83 – paragraph 5 – point ea (new) (Article 3 – paragraph 1 – point 14 a (new))
Authored by
Regulation (EU) 2016/679
Article 83 – paragraph 5 – point ea (new)
Text proposed by the Commission
Amendment
14a. In Article 83 paragraph 5, the following point ea is added: " (ea) non-compliance with Article 88b. "Justification
The amendment ensures that Article 88b can be enforced in practice.
noyb's comment:
This amendment makes violations of the proposed Article 88b subject to the higher fine-category.
#1349 Article 83 – paragraph 9a (new) (Article 3 – paragraph 1 – point 14 b (new))
Authored by
Regulation (EU) 2016/679
Article 83 – paragraph 9a (new)
Text proposed by the Commission
Amendment
14b. In Article 83, paragraph 9a is added: " (9a) Without prejudice to paragraphs 4, 5 or 6 or Member States law, supervisory authorities shall in any case confiscate all profits made from an infringement of this Regulation by large controllers. "Justification
Certain industry sectors, such as social media companies, primary make their revenue from the unlawful processing of personal data. In such cases, where almost 100% of the profits are made from unlawful processing, the 4% fine under Article 83 is not sufficient as a deterrent, but amounts more to a tax for unlawful actions. As in many other laws, the requirement to confiscate unlawful profits shall be added to ensure fair competition and efficient enforcement.
noyb's comment:
This amendment would drastically reduce the appeal of business models violating the GDPR. Therefore, it would increase the level of data protection. Part of a simplification package also lowering fines for small controllers.
#1363 Article 88a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2026/679
Article 88a
Text proposed by the Commission
Article 88aAmendment
deletedJustification
Deletion of new article 88a
#1364 Article 88a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a
Text proposed by the Commission
Article 88aAmendment
deleted
#1472 Article 88b – paragraph 1 – point a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a
Text proposed by the Commission
(a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;Amendment
(a) Give, reject and withdraw consent through automated and machine-readable means, provided that such means allow specific and informed choices;
noyb's comment:
Improves the scope of the automated signals (adding withdrawal), but only refers to specific and informed choices instead of the all consent conditions.
#1479 Article 88b – paragraph 1 – point b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point b
Text proposed by the Commission
(b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.Amendment
(b) exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.
#1494 Article 88b – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 2
Text proposed by the Commission
(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.Amendment
(2) Controllers shall disclose the purposes for which they request consent or where a data subject can object through automated and machine-readable means and respect the choices made by data subjects in accordance with paragraph 1 and 6.
noyb's comment:
Potentially removes the obligation that signals are mandatory ("can").
#1502 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 3
Text proposed by the Commission
(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.Amendment
deleted
noyb's comment:
Broader application for automated signals, less interruptions for users, unique simpler experience for most interfaces. Exception is questionable from an equality before the law perspective.
#1515 Article 88b – paragraph 4 – first subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph
Text proposed by the Commission
The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices.Amendment
The Commission may, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. It shall make such a request within 3 months from the coming into force of this regulation for websites and web browsers. The standardization organization shall ensure that consumers and data subjects are represented in the standardization process.
noyb's comment:
Adds a deadline for at least some standardisation elements.
#1538 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 6
Text proposed by the Commission
(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.Amendment
(6) Providers of software to access online interfaces shall provide third-party consent management software to manage the choices referred to in paragraph 1 on behalf of data subjects within 3 months of any standard under paragraph 4 being adopted. Third-party consent management software shall not have any commercial interest in the choices of the data subject and provide a neutral interface. Automated choices by a consent management software shall be deemed valid under this Regulation.
noyb's comment:
Broadens the scope of who should provide "automated signal options" and how they can be managed..
#1544 Article 88b – paragraph 7 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 7
Text proposed by the Commission
(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].Amendment
deleted
noyb's comment:
Can be read as good for privacy (shortening the time for application) or as negative as a part of deleting the article, given that an implementation in 20 days [when the Article would apply] seems too ambitious.
#1555 Article 88c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c
Text proposed by the Commission
Article 88cAmendment
Article 88cJustification
Deletion of the whole article 88c
noyb's comment:
With such deletion, the regime stays the same as currently.
#1723 Article 5 – paragraph 3 (Article 5 – paragraph 1 – point 2 – introductory part)
Authored by
Directive 2002/58/EC
Article 5 – paragraph 3
Text proposed by the Commission
2. After Article 5(3), the following subparagraph is added:Amendment
2. Article 5(3) is replaced by the following:
#1728 Article 5 – paragraph 3 (Article 5 – paragraph 1 – point 2)
Authored by
Directive 2002/58/EC
Article 5 – paragraph 3
Text proposed by the Commission
This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.Amendment
3. Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed when that person has given his or her consent, in accordance with Regulation (EU) 2016/679. This shall not prevent any technical storage or access and the corresponding processing of personal data if it is exclusively related to and strictly necessary for: a) carrying out the transmission of an electronic communication over an electronic communications network; b) providing a service explicitly requested by the subscriber or user; c) measuring the general audience of an online service requested by a subscriber or user in an immediately anonymised and aggregated form; d) maintaining or restoring the technical security of a service explicitly requested by the subscriber or user through strictly proportionate means; If the subscriber or user refuses a request for consent, the provider shall not make a new request for consent for the same purpose for a period of at least six months. Refusing to give consent should not be more difficult than giving consent. Consent shall by default not be considered to be given in an informed and specific manner when the request for consent involves the disclosure of data to more than 10 controllers in a single action. Member States shall designate the competent supervisory authority under Regulation (EU) 2016/679 for the supervision and enforcement of the rules under this paragraph.
noyb's comment:
Broader exceptions than the current framework, but very helpful provisions on deceptive design and informed consent.