20 GDPR-relevant amendments by Verena Mertens
#259 Recital 30
Authored by
Text proposed by the Commission
(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. This Regulation shall not apply to AI systems developed exclusively by competent authorities within the meaning of Directive (EU) 2016/680 for their own operational use in the prevention, detection, investigation or prosecution of criminal offences, provided that such systems are not placed on the market or made available to third parties. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.
noyb's comment:
This amendment woudl limit the scope of Directive (EU) 2016/680.
#266 Recital 30 a (new)
Authored by
Text proposed by the Commission
Amendment
(30a) When applying Union rules on artificial intelligence to competent authorities for the prevention, investigation, detection or prosecution of criminal offences, unnecessary duplication of legal and administrative obligations should be avoided. Such authorities already operate within the comprehensive safeguards established by Directive (EU) 2016/680 and national constitutional oversight mechanisms. Regulatory requirements should therefore remain proportionate and should not create overlapping compliance structures which reduce operational capacities without providing an equivalent increase in the protection of fundamental rights.
noyb's comment:
Highlighting the limtiations of the GDPR. While this can be read as a mere restatement, it can have impact in business-to-governemnt processing situations, that can be covered by the GDPR so far.
#267 Recital 30 b (new)
Authored by
Text proposed by the Commission
Amendment
(30b) In particular, the application of obligations designed primarily for economic operators placing AI systems on the internal market should not impose disproportionate administrative burdens on competent public authorities using AI systems exclusively for the exercise of public powers in accordance with Union and national law. Simplification measures should preserve the operational effectiveness of law enforcement authorities, especially where AI supports the fight against organised crime, terrorism and child sexual abuse.
noyb's comment:
Highlighting the limtiations of the GDPR. While this can be read as a mere restatement, it can have impact in business-to-governemnt processing situations, that can be covered by the GDPR so far.
#268 Recital 30 c (new)
Authored by
Text proposed by the Commission
Amendment
(30c) Member States may provide that, where AI systems are developed, tested, validated or deployed by competent authorities within the meaning of Directive (EU) 2016/680 for the prevention, detection, investigation or prosecution of criminal offences, such processing may be considered to pursue an important public interest, provided that appropriate safeguards under Union and national law apply.
noyb's comment:
Highlighting the limtiations of the GDPR. While this can be read as a mere restatement, it can have impact in business-to-governemnt processing situations, that can be covered by the GDPR so far.
#282 Recital 32
Authored by
Text proposed by the Commission
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. Directive (EU) 2016/680 constitutes the lex specialis governing the processing of personal data by competent authorities for law enforcement purposes and provides the specific data protection framework applicable to such processing. The obligations laid down in this Regulation should therefore be interpreted and applied in a manner that avoids unnecessary duplication of safeguards and administrative obligations already ensured under Directive (EU) 2016/680 and national law. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.
#305 Recital 33
Text proposed by the Commission
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.Amendment
(33) The development, training, testing, validation, deployment, operation and monitoring of AI systems and AI models may require the processing of personal data. Such processing may constitute a legitimate interest of the controller or a third party within the meaning of Article 6(1), point (f), where appropriate, provided that the interests or fundamental rights and freedoms of the data subject do not override that interest, taking particular account of whether the data subject is a child. Where public authorities process personal data for the performance of a task carried out in the public interest or in the exercise of official authority vested in them, Article 6(1), point (e), in conjunction with Union or Member State law referred to in Article 6(3), should remain the appropriate legal basis. Controllers should use non-personal or anonymised data where the intended purpose can reasonably and effectively be achieved by using such data. Where the processing of personal data is necessary, pseudonymised data should be used wherever the intended purpose can reasonably and effectively be achieved by using such data. Appropriate technical and organisational measures should be implemented throughout the lifecycle of the AI system or AI model. Such measures should include data minimisation during the selection of sources and the training, testing and validation of the system or model, the use of state-of-the-art privacy-enhancing technologies, and measures to prevent memorisation, regurgitation, data leakage and the unauthorised disclosure of personal data through outputs. Personal data should only be included in an output where this is necessary for the intended purpose, the recipient is authorised to receive those data and the disclosure has a legal basis under Article 6 and, where applicable, Article 9. Particular protection should be afforded to special categories of personal data referred to in Article 9(1).
noyb's comment:
This proposed amendment does not go far beyond the Omnibus proposal. It allows the new limitation to the GDPR and only repeats existing requirements (mainly implementations of data minimization) as safeguards.
#347 Recital 36 a (new)
Authored by
Text proposed by the Commission
Amendment
(36a) To reduce administrative burdens for civil-society and volunteer-based organisations, associations and non-profit entities should not be subject to the full scope of the regulation and in particular not of information and record-keeping obligations of Regulation 2016/679, provided their data processing is limited to low-risk internal administrative purposes and does not involve systematic monitoring or high-risk operations. Member States should ensure that such entities can fulfil transparency obligations through general public information rather than individual notices
noyb's comment:
Reducing the scope for certain organisations simplifies GDPR compliance for those organisations while reducing the level of data protection. E.g. certain data subjects would not be informed about the processing of their data.
#397 Recital 41
Authored by
Text proposed by the Commission
(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council16 applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council17 applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brough into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. _________________ 16 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). 17 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).Amendment
(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council16 applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council17 applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Where competent authorities within the meaning of Directive (EU) 2016/680 demonstrate that equivalent safeguards are ensured under Union or national law, compliance with corresponding safeguards under this Regulation should be presumed. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brough into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. _________________ 16 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). 17 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).
noyb's comment:
The meaning of this addition is unclear (e.g. what “equivalent safeguards” refer to). Due to the different scope of the legal acts, it is also unclear, how broad any comparison of safeguards should be. However, any presumption of compliance contrary to the principle of accountability could potentially be seen as effectively reducing the level of privacy.
#1106 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)
Regulation (EU) 2016/679
Article 13 – paragraph 4
Text proposed by the Commission
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.Amendment
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, or where the provision of such information proves impossible or would involve a disproportionate effort, taking into account the nature, scope, context and purposes of the processing, the size and resources of the controller, and the risk to the rights and freedoms of natural persons, unless the controller transmits the data to other recipients or categories of recipients for purposes other than those directly related to the clear and circumscribed relationship with the data subject, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35. In such cases, the controller shall take appropriate measures to protect the rights and freedoms and legitimate interests of the data subject, including, where appropriate, making the information publicly available in an easily accessible form.Justification
Information obligations are essential for transparency, but they should remain proportionate and workable in low-risk situations. The Commission proposal rightly introduces an exemption for clear and circumscribed relationships where the controller does not carry out data-intensive activities. However, the exemption should also cover situations where individual information proves impossible or would involve a disproportionate effort, provided that appropriate safeguards are maintained. In addition, the mere transmission of data to recipients should not automatically exclude the exemption where such transmission is directly related to the existing relationship with the data subject, for example in the context of associations, non-profit organisations, craft businesses or small enterprises. This amendment preserves transparency while reducing unnecessary administrative burdens.
noyb's comment:
Building upon the Commission’s proposal, this amendment similarly allows for further cases where no information to data subjects is provided (and goes even further). As does the Com proposal, this provision is overly complex and almost unworkable in practise. A lack of information typcially violates the "fairness" principle in Article 8(2) of the Charter.
#1128 Article 13 – paragraph 4a (new) (Article 3 – paragraph 1 – point 6 a (new))
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 4a (new)
Present text
Article 13 Information to be provided where personal data are collected from the data subject 1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: (a) the identity and the contact details of the controller and, where applicable, of the controller's representative; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; (e) the recipients or categories of recipients of the personal data, if any; (f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available. 2. In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability; (c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (d) the right to lodge a complaint with a supervisory authority; (e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; (f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. 3. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2. 4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.Amendment
6a. In Article 13, paragraph 4a is added: "Paragraphs 1 to 4 shall not apply to associations, foundations, and other non-profit organisations established in the Union, provided that: (a) the processing of personal data is limited to the administration of membership, volunteers, donors, or beneficiaries; (b) such processing is not likely to result in a high risk to the rights and freedoms of natural persons; and (c) the data are not shared with third parties for commercial purposes."Justification
Article 13 information obligations are essential for transparency, but they can create disproportionate administrative burdens for small non-profit organisations where the processing relationship is clear, direct and limited to internal administrative purposes. Associations, foundations and other non-profit organisations should therefore be allowed to fulfil transparency obligations through publicly accessible information where processing is limited to members, volunteers, donors or beneficiaries, does not involve systematic monitoring, is not likely to result in a high risk and is not used for commercial third-party sharing. This targeted clarification supports civic engagement and volunteer work while preserving the substance of the right to information.
noyb's comment:
This proposal adds an exemption from the information obligation similar to the Commission's proposal but limited in its scope. Unlike the Commission's proposal, this version is much clearer and the added legal uncertainty is probably lower than the administrative simplification. Such a broad ecemption of information duties likely violates the "fairness" principle in Article 8(2) of the Charter.
#1563 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)
Regulation (EU) 2016/679
Article 88c – paragraph 1
Text proposed by the Commission
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Amendment
1) Where the processing of personal data is necessary for the purposes of the development, training, testing, validation, deployment, operation or monitoring of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or of an AI model, such processing may constitute a legitimate interest within the meaning of Article 6(1), point (f), provided that: (a) the processing is necessary for the interest pursued by the controller or by a third party; (b) that interest is not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, taking particular account of whether the data subject is a child; and (c) no provision of Union or Member State law expressly requires the consent of the data subject for that processing.
noyb's comment:
The provision repeats the existing Article 6(1)(f) GDPR, without adding safeguards.
#1579 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)
Regulation (EU) 2016/679
Article 88c – paragraph 2
Text proposed by the Commission
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.Amendment
2) Where the task or official authority of a public authority or body is laid down by Union or Member State law in accordance with Article 6(3), personal data may be further processed for the purposes referred to in paragraph 1 on the basis of Article 6(1), point (e), where: (a) the development or use of the AI system or AI model serves the performance of that task or the exercise of that official authority; (b) the purpose pursued cannot be effectively achieved by processing non-personal or anonymised data; and (c) the processing is necessary and proportionate to the public interest objective pursued. This paragraph shall not confer any new task or official authority on a public authority or body. 3) Controllers shall use non-personal or anonymised data where the purpose of the processing can reasonably and effectively be achieved by using such data.Where the use of personal data is necessary, controllers shall use pseudonymised data wherever the purpose can reasonably and effectively be achieved by using such data. 4) Processing pursuant to paragraphs 1 and 2 shall be subject to appropriate technical and organisational measures and safeguards for the rights and freedoms of data subjects. Those measures shall include, as appropriate: (a) ensuring data minimisation during the selection of data sources and throughout the training, testing, validation, deployment and operation of the AI system or AI model; (b) limiting the processing to data that are adequate, relevant and necessary for the intended purpose; (c) applying state-of-the-art privacy-enhancing technologies, including pseudonymisation, where appropriate; (d) testing, monitoring and mitigating the risks of memorisation, regurgitation, data leakage, inference and unauthorised disclosure; (e) effectively preventing personal data retained or memorised in the AI system or AI model from being used to generate outputs which disclose or otherwise make those data available to persons not authorised to receive them; (f) ensuring that personal data are included in an output only where such inclusion is necessary for the intended purpose, the recipient is authorised to receive the data and the disclosure has a legal basis under Article 6 and, where applicable, Article 9; (g) providing appropriate transparency to data subjects; and (h) facilitating the exercise of the rights of data subjects under this Regulation. 5) Where the controller cannot effectively prevent the unauthorised disclosure of personal data through the output of the AI system or AI model, the controller shall not deploy or operate that system or model in a manner that enables such disclosure. 6) The processing of special categories of personal data shall be permitted only where one of the conditions laid down in Article 9(2) is fulfilled. Where point (k) of Article 9(2) applies, the conditions and safeguards laid down in Article 9(5) shall apply. 7) Paragraphs 1 to 6 shall be without prejudice to the other provisions of this Regulation, Regulation (EU) 2024/1689 and other applicable Union or Member State law.
noyb's comment:
The proposal allows for "further processing", usually understood as processing beyond the original purpose. While there is a long list of requirements, it is unclear why they would only apply to public tasks.
#1583 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2
Text proposed by the Commission
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.Amendment
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data. When assessing the safeguards required, account shall be taken of safeguards already provided for under Union or national law.
noyb's comment:
The amendment repeats the existing proposal, as well as existing GDPR obligations regarding the safeguards required.
#1599 Article 14 – paragraph 5a (new) (Article 3 – paragraph 1 a (new))
Authored by
Regulation (EU) 2016/679
Article 14 – paragraph 5a (new)
Present text
Article 14 Information to be provided where personal data have not been obtained from the data subject 1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information: (a) the identity and the contact details of the controller and, where applicable, of the controller's representative; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) the categories of personal data concerned; (e) the recipients or categories of recipients of the personal data, if any; (f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available. 2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; (c) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability; (d) where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (e) the right to lodge a complaint with a supervisory authority; (f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources; (g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. The controller shall provide the information referred to in para graphs 1 and 2: (a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circum stances in which the personal data are processed; (b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or (c) if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed. 4. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2. 5. Paragraphs 1 to 4 shall not apply where and insofar as: (a) the data subject already has the information; (b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available; (c) obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject's legitimate interests; or (d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.Amendment
In Article 14, paragraph 5a is added: "'5a. Where the controller is an association, foundation, or other non-profit organisation, and the personal data have not been obtained from the data subject, paragraphs 1 to 5 shall not apply where providing the information would require a disproportionate effort and the processing is limited to the internal purposes described in Article 13(6). In such cases, the controller shall adopt appropriate transparency measures.'"Justification
Non-profit organisations may receive personal data indirectly in the context of volunteer coordination, beneficiary support, charitable activities or membership-related administration. In such situations, providing individual information notices to each data subject can require disproportionate effort, particularly for small or volunteer-based organisations. This amendment allows proportionate transparency measures, such as public notices or online publication, where the processing remains limited to low-risk internal purposes. It preserves transparency while avoiding unnecessary bureaucracy for civil-society organisations.
noyb's comment:
The amendment includes a derogation which is not foreseen in the current regime.
#1600 Article 30 – paragraph 5a (new) (Article 3 – paragraph 1 b (new))
Authored by
Regulation (EU) 2016/679
Article 30 – paragraph 5a (new)
Present text
Article 30 Records of processing activities 1. Each controller and, where applicable, the controller's represen tative, shall maintain a record of processing activities under its respon sibility. That record shall contain all of the following information: (a) the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer; (b) the purposes of the processing; (c) a description of the categories of data subjects and of the categories of personal data; (d) the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or inter national organisations; (e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the docu mentation of suitable safeguards; (f) where possible, the envisaged time limits for erasure of the different categories of data; (g) where possible, a general description of the technical and organisa tional security measures referred to in Article 32(1). 2. Each processor and, where applicable, the processor's representa tive shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing: (a) the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller's or the processor's represen tative, and the data protection officer; (b) the categories of processing carried out on behalf of each controller; (c) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the docu mentation of suitable safeguards; B (d) where possible, a general description of the technical and organisa tional security measures referred to in Article 32(1). 3. The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form. 4. The controller or the processor and, where applicable, the controller's or the processor's representative, shall make the record available to the supervisory authority on request. 5. The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.Amendment
In Article 30, paragraph 5a is added "'5a. Paragraphs 1-4 shall not apply to associations, foundations, and other non-profit organisations whose processing activities are limited to the purposes described in Article 13(6).'"Justification
Record-keeping obligations under Article 30 should be proportionate to the actual risk of the processing activity. Small non-profit organisations, associations and foundations often lack dedicated compliance structures and process data only for limited internal administrative purposes. Requiring full records of processing activities in such low-risk cases creates administrative burdens without a corresponding benefit for data subjects. This amendment clarifies that the exemption applies to non-profit organisations where processing is limited to the purposes set out in Article 13(6), while preserving the full obligation where processing is likely to result in a high risk to the rights and freedoms of data subjects.
noyb's comment:
While this amendment aims to add a new paragraph, it – apparently incorrectly – shows a deletion of the existing Article 30(1) GDPR. Not taking this into account, the reduction of the scope of Article 30 for certain organisations would – for them – reduce their administrative workload.
#1601 Article 2 – paragraph 2 – point e (new) (Article 3 – paragraph 1 c (new))
Authored by
Regulation (EU) 2016/679
Article 2 – paragraph 2 – point e (new)
Present text
2. This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity;Amendment
In Article 2, the following point e is added: "'(e) by associations, foundations and other non-profit organisations established in the Union, where the processing is carried out solely in the course of their statutory non-commercial activities and is limited to the administration of members, former members, volunteers, donors or beneficiaries, provided that such processing does not involve systematic monitoring or processing likely to result in a high risk to the rights and freedoms of natural persons within the meaning of Article 35, and that the personal data are not disclosed to third parties for commercial purposes.'"Justification
Associations, foundations and other non-profit organisations generally process personal data within clear, direct and non-commercial relationships with their members, volunteers, donors or beneficiaries. Subjecting such limited and low-risk processing to the full scope of Regulation (EU) 2016/679 places a disproportionate administrative burden on civil-society and volunteer-based organisations, many of which lack dedicated compliance structures. This targeted exclusion complements the specific simplifications proposed for Articles 13, 14 and 30, while preserving the application of the Regulation to systematic monitoring, automated decision-making, high-risk processing and the commercial disclosure of personal data.
noyb's comment:
The amendment reduces protection by limiting the scope of the GDPR but with that simplifying compliance for the affected controllers. At the same time cooperation with controllers covered by the GDPR will likely be more complicated.
#1602 Article 9 – paragraph 2 – point k (new) (Article 3 – paragraph 1 d (new))
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k (new)
Present text
2. Paragraph 1 shall not apply if one of the following applies: (a)the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject; (b)processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject; (c)processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; (d)processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;(e)processing relates to personal data which are manifestly made public by the data subject;(f)processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity; (g)processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; (h)processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3; (i)processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;Amendment
In Article 9, paragraph 2 the following point k is added: "'(ja) processing is strictly necessary for the anonymisation of personal data pursuant to Article 6(3a), provided that the processing is subject to appropriate technical and organisational safeguards, that the data are not used to take measures or decisions concerning individual data subjects and that identifiable data are erased or rendered inaccessible as soon as they are no longer necessary for the anonymisation process.'"
#1603 Article 80 (Article 3 a (new))
Authored by
Regulation (EU) 2016/679
Article 80
Present text
Article 80 Representation of data subjects 1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.Amendment
Article 3 a (new) Article 80 is deleted. ""
noyb's comment:
The amendment removes the right for data subjects to mandate a representative.
#1604 Article 6 – paragraph 3a (new) (Article 3 b (new))
Authored by
Regulation (EU) 2016/679
Article 6 – paragraph 3a (new)
Present text
3. The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:(a)Union law; orAmendment
Article 3 b (new) In Article 6, the following paragraph 3a is inserted: "3a. Further processing of personal data for the sole purpose of anonymising those data shall be considered compatible with the purposes for which the personal data were initially collected and shall be lawful on the basis applicable to the initial processing."
noyb's comment:
This amendment allows controllers a derogation to anonymise data by claiming legitimate interest as a legal basis. This amendment can be beneficial for both controllers and data subjects.
#1605 Article 4 – point 5a (new) (Article 3 c (new))
Authored by
Regulation (EU) 2016/679
Article 4 – point 5a (new)
Present text
Article 4Definitions For the purposes of this Regulation: (1)‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; (2)‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; (3)‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future; (4)‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;Amendment
Article 3 c (new) In Article 4, the following point 5a is inserted "'(5a) “anonymisation” means the processing of personal data in such a manner that the resulting information does not or no longer constitute personal data for the controller or recipient concerned because the natural person to whom the information relates cannot be identified by means reasonably likely to be used by that controller or recipient, taking into account all objective factors and the means and criteria referred to in Article 41a;'"
noyb's comment:
(Full) anonymization can be good approahc. However, the Amendment now defines "relative" anonymization (conroller or a recipient). It also grants the power to determine the application of the GDPR to the Commission, which could violate Article 8(3) of the Charter.