24 GDPR-relevant amendments by Pekka Toveri
#216 Recital 27
Authored by
Text proposed by the Commission
(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council15 . The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act. _________________ 15 Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (OJ L, 2025/327, 5.3.2025, ELI: http://data.europa.eu/eli/reg/2025/327/oj)Amendment
(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given person or entity where that person or entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council. It should also be clarified that information, which is apparently impersonal, may still be considered personal data if the data subject can be identified with additional information obtained from another person or entity through means reasonably likely to be used making it possible to identify the data subject. In such circumstances, the fact that the information enabling the data subject to be identified is in the hands of other people does not prevent that data subject from being identifiable for the controller. The Court of Justice of the European Union has also held that information which are in themselves impersonal may become personal in nature where the controller puts them, or is likely to put them, at the disposal of other persons or entities who have means reasonably likely to enable the data subject to be identified. It is apparent, in particular, that if that information is put at these other persons or entities’ disposal – then this information is personal data for these persons and entities and, indirectly, for the controller. Accordingly, in so far as it cannot be ruled out that those persons or entities have means reasonably allowing them to attribute pseudonymised data to the data subject, such as cross-checking with other data at their disposal, the data subject must be regarded as identifiable as regards both that transfer and any subsequent processing of those data by those persons and entities. In such circumstances, pseudonymised data should be considered to be personal data. The Commission, together with the European Data Protection Board, may support controllers in the application of this updated definition by stipulating technical criteria in an implementing act.
noyb's comment:
The Parliament's amendment improves the Commission’s proposal that is meant to introduce a subjective approach to the definition of personal data. However, even with the new protections that this amednment seeks to afford, while it highlights an objective approach, it seems partly contradictory and does not go beyond the current understanding of the GDPR.
#240 Recital 28
Authored by
Text proposed by the Commission
(28) In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as methodological and systematic approach applied while conducting the research in the specific area. Research and technology development should be conducted in academic, industry and other settings, including small and medium-sized undertakings, (Article 179(2) TFEU) and should be always of a of high quality and should adhere to the principles of principles of reliability, honesty, respect and accountability (verifiability).Amendment
(28) In order to assess whether an activity meets the conditions of being scientific research for the purpose of this Regulation, account should be taken of the following characteristics: novelty, creativity, uncertainty, systematic and transferable/reproducible. Consideration should also be given to the purpose of the activity, which should primarily aim at new findings, based on original concepts (and their interpretation) or hypotheses. The Frascati Manual will be the main reference for this assessment.
noyb's comment:
Seems like an attempt to clarify scientific research in more detail, however the impact seems to be rather limited.
#300 Recital 33
Authored by
Text proposed by the Commission
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.Amendment
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including which may include personal data and special categories thereof. Special categories of personal data may incidentally and residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing and while the controller did not intend to process such personal data and has taken the appropriate technical and organisational measures to avoid such processing, such as the filtering out of special categories of personal data at the collection stage. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, including technical capabilities derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed for incidental and residual processing of special categories of data in the context of the development and technical operation of AI systems or AI models. The derogation should not be understood as covering the processing of special categories of personal data directly acquired by or provided to the AI system or AI model in the course of the deployment. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle, such as the development and operation, of an AI system or AI model, and, once it identifies such data, effectively remove them. If removal would require manifestly disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model the controller should effectively protect such data from being further processed or processed for other purposes, in particular used to infer outputs, being disclosed or otherwise made available to third parties. The controller should document its assessment and have processes in place to monitor and demonstrate the effectiveness of these measures. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing, for example if special categories of personal data relating to a natural person’s voice, image or other personal characteristics are used in a way that goes beyond incidental or residual existence. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679 or in another Union law, such as Regulation (EU) 2024/1689 regarding the processing of special categories of personal data for the purpose of ensuring bias detection and correction. The notion of AI system and AI model should be understood in the same manner as in Regulation (EU) 2024/1689.
noyb's comment:
This amendment goes further than the Commission's proposal, but in certain aspects takes a step back from the GDPR (e.g. development & operation of AI). Overall mixed direction.
#375 Recital 38 a (new)
Authored by
Text proposed by the Commission
Amendment
(38a) While Article 28 of Regulation 2016/679 establishes a robust framework for contractual accountability, its practical application has created a structural asymmetry when controllers often rely on systemic digital actors designated as gatekeepers under Regulation (EU) 2022/1925. This creates a redundant administrative burden for small and medium-sized enterprises (SMEs), small mid-cap enterprises (SMCs) and public authorities. To eliminate this red tape and enhance digital sovereignty, a direct compliance mechanism should apply solely to gatekeepers by way of derogation from Article 28. Where a processor is a designated gatekeeper, its core data protection duties should come directly from this Regulation. Processors not designated as gatekeepers do not possess equivalent market power and remain entirely subject to the standard contractual framework, preserving contractual freedom and a competitive digital ecosystem.
noyb's comment:
Requiring certain processors (gatekeepers) to directly apply certain provisions would make it easier to enforce those provisions against those actors which would increase the level of data protection since currently, responsibility is often shifted to controllers using the services of those processors even if they factually cannot influence the processing in a manner typical to a controller. Not requiring processors to audit processors would reduce complexity as well.
#394 Recital 40 a (new)
Authored by
Text proposed by the Commission
Amendment
(40a) Regulation (EU) 2016/679 follows a technology-neutral, risk-based and purpose-driven approach to the processing of personal data. The lawfulness of processing should be determined by reference to a specific and legitimate purpose and an assessment of the risks posed to the rights and freedoms of natural persons, taking into account the nature, scope, context and purposes of the processing. Where personal data are processed through the terminal equipment of natural persons, and the available indicators demonstrate that the likelihood and severity of risks to those rights and freedoms are limited, reliance on legal bases other than consent may be justified, where appropriate.
noyb's comment:
Allowing further legal bases for the processing through terminal equipment of natural persons would reduce the level of data protection.
#439 Recital 44 – paragraph 3
Authored by
Text proposed by the Commission
With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. The controller, such as a media service provider, may mandate a processor, such as a market research company, to carry out the processing on its behalf.Amendment
With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. This list should include measuring the audience of an online service by creating aggregated information about the usage of an online service, where it is carried out by the provider of that online service, or by a third party, such as a market research company or a Joint Industry Committee, acting together with or on behalf of this provider. ‘Audience measurement’ should be understood in accordance with Article 2(16) and with Article 24(1) of Regulation (EU) 2024/1083. Gatekeepers designated under Regulation (EU) 2022/1925 carrying out audience measurement may not rely on article 88a(3)c of this Regulation. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. The controller, such as a media service provider, may mandate a processor, such as a market research company, to carry out the processing on its behalf.
noyb's comment:
Relies on further exceptions to the current legal framework.
#940 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – second part
Text proposed by the Commission
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.Amendment
Information relating to a natural person, depending on the circumstances of the case, is not necessarily personal data for every other person or entity, in so far as that person or entity cannot identify that natural person to whom the information relates taking into account the means reasonably likely to be used by that person or entity, Information relating to a natural person is, however, personal data where this information is likely to be put or is put at the disposal of other persons or entities who have the means reasonably likely to enable the data subject to be identified.
noyb's comment:
The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1).
#970 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38
Text proposed by the Commission
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.Amendment
(38) “scientific research” means creative and systematic work undertaken in order to increase the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts without any particular application or use in view, or through original investigation undertaken in order to acquire new knowledge directed primarily towards a specific, practical aim or objective. This does not exclude that the research may also aim to further a commercial interest.
noyb's comment:
Wider scope than current understanding. Mainly formal criteria. Not overly clear.
#1025 Article 9 – paragraph 2 – point k (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k
Text proposed by the Commission
(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.Amendment
(k) incidental and residual processing in the context of the development, training, testing, deployment and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model as referred to in Regulation (EU) 2024/1689, including for the improvement of such systems or models and of related products or services, subject to the conditions referred to in paragraph 5.
noyb's comment:
This amendment proposes to add the terms incidental and residual to the article but adds the improvement of models or services in the proposed provision.
#1127 Article 14 – paragraph 5a (new) (Article 3 – paragraph 1 – point 6)
Authored by
Regulation (EU) 2016/679
Article 14 – paragraph 5a (new)
Text proposed by the Commission
Amendment
5a. In Article 14, paragraph 5a is added: '5a. The obligation to make information available pursuant to Article 14 shall be deemed fulfilled where such information is published and maintained in an easily accessible manner on the entity's website.'
noyb's comment:
This proposal provides for an easy (for controllers) way to provide the Article 14 information. However, data subjects would be unable to be aware of the processing of their data in numerous cases. In particular in case of Article 14 which applies when information is collected indirectly. Data subjects are therefore usually unaware. Sch a broad exemption is certainly not proportionate and therefore in violaution the fairness principle of Article 8(2) of the CFR.
#1168 Article 28 – paragraphs 3a, 3b, 3c (new) and paragraph 4 (Article 3 – paragraph 1 – point 7 b (new))
Authored by
Regulation (EU) 2016/679
Article 28 – paragraphs 3a, 3b, 3c (new) and paragraph 4
Text proposed by the Commission
Amendment
7b. In Article 28, the following paragraphs 3a, 3b and 3c are added and paragraph 4 is amended as follows: '3a. By way of derogation from paragraph 3 and the general processor requirements therein, where a processor has been designated as a gatekeeper pursuant to Article 3 of Regulation (EU) 2022/1925, the processing shall instead be governed directly by this Regulation. Any such gatekeeper processor shall strictly adhere to the following obligations: (a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; (b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; (c) takes all measures required pursuant to Article 32; (d) respects the conditions referred to in paragraphs 2 and 4 for engaging another processor; (e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III; (f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor; (g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data; (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions. 3b. A controller that is using a gatekeeper as a processor may form a contract or other legal act under Union or Member State law, that is binding on the gatekeeper processor and that sets out further details, like the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. Such contracts shall not contain terms that are unfair or limit the rights of the controllers under this Regulation. 3c. A contractual term shall be regarded as unfair if it requires undue extra payment for the exercise of rights of the controller, limits the rights of the controller to enforce the contract or otherwise legally, factually or economically interferes with the rights of controllers under this Regulation. The European Commission shall specify further terms of a contract that are regarded as unfair in accordance with the examination procedure referred to in Article 93(2). 4. Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in paragraph 3 to 3c shall apply or, if this Regulation does not apply to them directly, be imposed on that other processor by way of a contract or other legal act under Union or Member State law and jurisdiction, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor’s obligations.'
noyb's comment:
The proposed text includes additional safeguards in the GDPR against gatekeepers designated by the DMA. This can be an overall benefit to the fundamental rights of data subjects. It can also lead to simpler transactions in B2B relationships.
#1302 Article 41b (new) (Article 3 – paragraph 1 – point 10 a (new))
Authored by
Regulation (EU) 2016/679
Article 41b (new)
Text proposed by the Commission
Amendment
10a. The following Article 41b is inserted: 'Article 41b Application of pseudonymisation and identification of a natural person (1) Controllers and processors may apply pseudonymisation, and anonymisation, or other Privacy Enhancing Technologies referred to in Article 25a to personal data in order to reduce the risks to the data subjects concerned and to help meet their obligations under this Regulation, in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information. To determine whether a natural person is identifiable, including through personal data having undergone pseudonymisation, account shall be taken of all the means reasonably likely to be used, such as singling out or online identifiers, either by the controller or by another person to identify the natural person directly or indirectly. (2) Paragraph 1 is without prejudice to other provisions and obligations applicable to the controller and processor, including under Chapter IV and V of this Regulation. (3) The Board shall issue an opinion, in accordance with Article 64(2) of this Regulation, addressing the application of pseudonymisation and anonymisation to personal data, including related technical and organisational measures, and specifying means and criteria to determine whether and when such may effectively prevent persons other than the controller from identifying a data subject, in such a way that, for them, the data subject is not or is no longer identifiable, and where information relating to the data subject no longer constitutes personal data for that person other than the controller. (4) The Chair of the Board shall request the opinion referred to in paragraph 3 no later than 6 months after the entry into force of this Regulation. The opinion shall be reviewed and updated where necessary. (5) The Commission may adopt implementing acts specifying technical and organisational criteria, methodologies and standards where necessary to ensure uniform conditions for the application of paragraphs 1 and 3, or where further clarity is required following the issuance of the opinion referred to in paragraph 3, The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).'
noyb's comment:
The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1) and Article 4(5).
#1370 Article 88a – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 1
Text proposed by the Commission
(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.Amendment
(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject, and any subsequent processing necessary to achieve the purpose for which the data subject has given consent is only allowed when that person has given his or her consent, in accordance with this Regulation.
noyb's comment:
Unclear versus the current situation with the ePrivacy Directive given the confusing terminology, better than the Commission proposal.
#1383 Article 88a – paragraph 3 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3
Text proposed by the Commission
(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:Amendment
(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:
#1387 Article 88a – paragraph 3 – point b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point b
Text proposed by the Commission
(b) providing a service explicitly requested by the data subject;Amendment
(b) providing a service or the maintenance of a user session explicitly requested by the data subject;
noyb's comment:
Broadens the exception and does not provide additional legal certainty, given that a user session can be used for many different purposes (from necessary elements to ads).
#1393 Article 88a – paragraph 3 – point c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c
Text proposed by the Commission
(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;Amendment
(c) creating information about the usage of an online service solely for the use of the provider of that service;
noyb's comment:
Broadens the new exception proposed. No need to aggregate/anonymize the data.
#1397 Article 88a – paragraph 3 – point ca (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point ca (new)
Text proposed by the Commission
Amendment
(ca) In Article 83, paragraph 3, the following point ca is inserted: '(ca) performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083.'
noyb's comment:
New exception to the rule. Also, wronlgy refers to Article 83 instead of 88.
#1398 Article 88a – paragraph 3 – point d (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point d
Text proposed by the Commission
(d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.Amendment
(d) maintaining or restoring the security, integrity and functioning of a service provided by the controller and requested by the data subject or the security of the terminal equipment used for the provision of such service, including detecting, preventing or mitigating fraud, automated or non-human traffic, unauthorised access, misuse of the service, circumvention of technical access conditions, or other uses that are contrary to the provider’s terms and conditions
noyb's comment:
Broadens the exception and makes the interpretation of the law subject to private terms and conditions, allowing to enforce them via accesst to other's PCs, smart phones or servers. Likely to go beyond any proportinality under Article 7 and 8 of the Charter.
#1406 Article 88a – paragraph 3 – point da (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)
Text proposed by the Commission
Amendment
(da) In Article 88a, paragraph 3, the following point da is added: '(da) legitimate purposes in relation to contextual advertising, including measuring the performance and reach of such advertisement or capping the frequency with which such advertisement is being displayed.'
#1410 Article 88a – paragraph 3 – point db (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point db
Text proposed by the Commission
Amendment
(db) In Article 88a, paragraph 3, the following point db is added: '(db) ‘legitimate interests’ according to Article 6(1)(f) of this regulation provided that the controller applies Privacy Enhancing Technologies (PETs) in accordance with the technical standards adopted pursuant to Article 25a. This point shall not apply to processing operations that involve tracking or profiling a data subject's behaviour for the purposes of behavioural advertising, regardless of whether there is a direct relationship with the data subject. This does not preclude the processing of data for internal product optimisation, provided such processing is not used to track the user.'
noyb's comment:
New exception introduced. Very vague, mixing different concepts (personal data, legitimate interest and PETs).
#1424 Article 88a – paragraph 4 – introductory sentence (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4 – introductory sentence
Text proposed by the Commission
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:Amendment
Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject is based on consent, the following shall apply:
#1426 Article 88a – paragraph 4 – point a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point a
Text proposed by the Commission
(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;Amendment
(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means, except where the controller is a media service provider as defined in Article 2 (2) of Regulation (EU) 2024/108
noyb's comment:
Waters down clearer rules for user options and makes the nature of consent absurd in cases of media service providers. Overall leads to a more complex landscape. Questionable from an equality before the law perspective.
#1437 Article 88a – paragraph 4 – point c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c
Text proposed by the Commission
(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.Amendment
(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months, except where the controller is a media service provider as defined in Article 2 (2) of Regulation (EU) 2024/108.
noyb's comment:
Limits the Commission proposal in case of media providers. Questionable from an equality before the law perspective.
#1441 Article 88a – paragraph 4a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4a (new)
Text proposed by the Commission
Amendment
(4a) In Article 88a, the following paragraph 4a is inserted: '4a. Nothing in this Article shall prevent a media service provider from making access to its service conditional on either the data subject's consent to the processing of personal data for one or more specified purposes, or the payment of a reasonable fee for access to an equivalent version that does not involve such processing. Where such is offered, both options shall be presented to the data subject with equal prominence, in plain language and without the use of dark patterns.'
noyb's comment:
Makes refusing consent dependent on a payment. Questionable from an equality before the law perspective.