12 GDPR-relevant amendments by Mary Khan
#945 Article 4 – point 1 – paragraph 2 (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – paragraph 2
Text proposed by the Commission
‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’Amendment
When determining whether a natural person is identifiable, account shall be taken of all the means reasonably likely to be used by the controller, an actual or foreseeable recipient or any other actor in the processing chain. Pseudonymised data remains personal data, provided that re-identification by an actual or foreseeable recipient is legally and practically possible. The controller shall bear the burden of demonstrating that the risk of re-identification is objectively insignificant, taking into account the state of the art, available additional information and the intended audiences. A contractual ban on re-identification alone shall not suffice.Justification
Protection must not depend on whether an individual actor claims at any given time that they are unable to identify themselves. What matters is the real risk throughout the entire processing chain.
noyb's comment:
The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1). Mere forseeability should not dictate the possibility of entities to share data with each other, as a nature of an entity may change at any point, allowing them access to information that was not previously available. This can lead to re-identification of the data subjects.
#973 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38
Text proposed by the Commission
38. “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. they shall be carried out with the aim of contributing to the development of the general knowledge and well-being of society, while respecting ethical standards in the field of research concerned. This does not exclude that the research may also aim to further a commercial interest.’Amendment
38. “scientific research” means methodologically systematic, traceable and accountable research that is carried out in accordance with recognised scientific and ethical standards, follows a documented research agenda and serves the advancement of knowledge or a clearly defined public interest. A commercial interest does not preclude scientific research if it is secondary to the purpose of the research. General product development, targeted advertising, profiling, data trading and the training of general AI systems or AI models are not considered scientific research in themselves.Justification
Research privileges are intended for genuine science, not to be used as a blanket legal basis for commercial data exploitation.
noyb's comment:
Slightly stricter and clearer definition that current understaning.
#992 Article 5 – paragraph 1 – point b (Article 3 – paragraph 1 – point 2)
Authored by
Regulation (EU) 2016/679
Article 5 – paragraph 1 – point b
Text proposed by the Commission
collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);’Amendment
collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall only be considered to be compatible with the initial purposes, when the requirements of Article 6(4) and guarantees of Article 89(1) have been met. General product development as well as the training, testing or validation of general AI systems or AI models shall not be considered compatible purposes solely on the basis of their designation as research (‘purpose limitation’);Justification
Purpose limitation is a core principle of informational self-determination. A research label shall not replace testing.
noyb's comment:
The amendment pushes back against the derogation to Article 6(4) and specifies that AI training is not a compatible further purpose. However, this is the current state of law under the GDPR.
#1020 Article 9 – paragraph 2 – point k (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k
Text proposed by the Commission
(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.Amendment
deletedJustification
Specific categories of data shall not become the general data base for AI. A subsequent removal, which may be waived in the event of ‘disproportionate effort’, does not constitute effective protection.
noyb's comment:
With such deletion, the regime stays the same as currently, as interpreted by EDPB Opinion 28/2024.
#1037 Article 9 – paragraph 2 – point 1 (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point 1
Text proposed by the Commission
(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.’Amendment
(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject and the biometric data is neither centrally stored nor further processed for any other purpose.’
noyb's comment:
The amendment improves the Commission's proposal, but still allows additional processing.
#1047 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 5
Text proposed by the Commission
(b) the following paragraph shall be added: For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’Amendment
deletedJustification
Specific categories of data shall not become the general data base for AI. A subsequent removal, which may be waived in the event of ‘disproportionate effort’, does not constitute effective protection.
noyb's comment:
With such deletion, the regime stays the same as it currently is.
#1250 Article 41a (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a
Text proposed by the Commission
Article 41aAmendment
deletedJustification
The Commission could, by means of technical implementing acts, define entire categories of pseudonymised data as being outside the scope of the GDPR. Although pseudonymisation reduces risks, it does not eliminate the link to a person. A legal effect as fundamental as this must not be delegated to the Commission.
noyb's comment:
With such deletion, the regime stays the same as currently.
#1380 Article 88a – paragraph 2 a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 2 a (new)
Text proposed by the Commission
Amendment
In Article 88a, the following paragraph 2a is inserted: ‘(2a) This Article shall not be interpreted as a legal basis for accessing the content of electronic communications, for weakening, circumventing or preventing end-to-end encryption, for client-side scanning, for covert access to terminal equipment, for device fingerprinting or for cross-service tracking of natural persons. The confidentiality of communications and the protection of terminal equipment under Directive 2002/58/EC shall remain unaffected. Measures taken pursuant to Article 23 of this Regulation shall be determined by law, necessary and proportionate and, where there is significant infringement of fundamental rights, subject to prior independent judicial review.’Justification
Secure communication is a civil right. The rules governing terminal devices and cookies must never create a back door for content control or for making encryption technically weaker.
noyb's comment:
Introduces information about a, in general terms, privacy-friendly interpretation of the article.
#1497 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 3
Text proposed by the Commission
(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.Amendment
deleted
noyb's comment:
Broader application for automated signals, less interruptions for users, unique simpler experience for most interfaces. Exception is questionable from an equality before the law perspective.
#1516 Article 88b – paragraph 4 – first subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2026/679
Article 88b – paragraph 4 – first subparagraph
Text proposed by the Commission
The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices.Amendment
Technical specifications for machine-readable indications of choices shall be open, royalty-free, interoperable, publicly documented and independently verifiable. They shall be developed with the substantial involvement of the European Data Protection Board, national supervisory authorities, consumer organisations, SMEs and open-source software providers. Compliance with a standard shall not give rise to a presumption that the underlying processing is lawful.Justification
Machine-readable choices can reduce the number of cookie banners that appear. However, they must not generate blanket, pre-set or platform-derived consent, nor establish a proprietary default setting.
noyb's comment:
Describes how the specification should look like, but deletes who is tasked with making them.
#1518 Article 88b – paragraph 4 – second subparagraph (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 4 – second subparagraph
Text proposed by the Commission
Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.Amendment
deleted
#1551 Article 88c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c
Text proposed by the Commission
Article 88cAmendment
deletedJustification
The AI Act does not create a new legal basis for personal data. The existence of a legitimate interest must be assessed on a case-by-case basis and must not be predetermined by law in favour of AI providers.
noyb's comment:
With such deletion, the regime stays the same as it currently is.