Oliver Schenk

Text proposed by the Commission

Amendment

(29) It should be reiterated that further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. In such cases it is not necessary to ascertain on the basis of Article 6(4) of this Regulation whether the purpose of the further processing is compatible with the purpose for which the personal data are initially collected. The controller does not require a new legal basis for further compatible processing or derogation under Article 9(2), subject to the application of appropriate safeguards in accordance with Article 89(1).

noyb's comment:

The presumption of compatibility for sensitive data is foreseen in EDPB guidelines 1/2026. However, Article 8(2) of the Charter foresees a legal basis and purpose limitation, which seems to be entirely overturned for any research here.

#280 Recital 31

Authored by

Text proposed by the Commission

(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, providing an unconditional right to object to the processing of their personal data, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.

Amendment

(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.

noyb's comment:

The proposed amendment suggesting to remove the unconditional character of the right to object to AI processing operations diminishes the data subjects' control over their personal data.

#289 Recital 32

Authored by

Text proposed by the Commission

(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.

Amendment

(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR seeks to ensure a proportionate balance between the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.

noyb's comment:

Mainly linguistic

#291 Recital 32 a (new)

Authored by

Text proposed by the Commission

Amendment

(32a) The possibility of drawing conclusions regarding a data subject's health status through the combination, analysis or contextual interpretation of other data should not, in itself, result in the classification of such data as data concerning health for the purposes of Article 9. Data should only fall within the special category referred to in Article 9(1) where it directly and inherently discloses information concerning health, and not merely because such information could, in principle, be derived from it by a third party through further processing, enrichment or analysis.

noyb's comment:

The amendment restrains the scope of the definition in Article 9.

#292 Recital 32 a (new)

Authored by

Text proposed by the Commission

Amendment

(32a) To ensure legal certainty and support innovation, the processing of health data by a processor for the purposes of improving, maintaining, testing, ensuring the security of, or enhancing the performance of systems, models or services provided to a controller should not, in itself, result in that processor being considered a controller or joint controller, where such processing is carried out on behalf of the controller, within the purposes and scope determined by the controller, and subject to appropriate safeguards.

noyb's comment:

The amendment highlights innovation and creates a subjective test for the definition of controller.

#310 Recital 33 a (new)

Authored by

Text proposed by the Commission

Amendment

(33a) To ensure legal certainty and support the responsible development and use of artificial intelligence in the Union, it should be clarified that processing of personal data in the context of development, deployment, training, testing, operation and improvement of AI systems or models, including related products and services, may constitute a lawful ground under this Regulation where the conditions laid down in Article 9(2), point (k), are met.

noyb's comment:

The amendment goes further than the Commission's proposal.

#321 Recital 34

Authored by

Text proposed by the Commission

(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.

Amendment

(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should be allowed where the data subject is offered a non-biometric alternative and suitable safeguards are implemented to ensure fundamental rights of the data subject are adequately protected through the implementation of the necessary safeguards. For example, where the biometric data are securely stored solely by the device the side of the data subject, or the biometric data is are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, and subject to measures ensuring the overall security of the processing, including during the enrolment phase of data subject and at the time when the data subject agrees to share the biometric data or encryption key. Other examples of appropriate safeguards are ensuring that end-to-end encryption, or similar state of the art technology, is used when data are transmitted over a communication channel and providing data subjects with the possibility to securely erase their biometric data in accordance with Article 17 of Regulation (EU) 2016/679.

noyb's comment:

The amendment almost goes back to a consent requirement, like under the current text, and includes an obligation to provide a less intrusive alternative.

#369 Recital 38

Authored by

Text proposed by the Commission

(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.

Amendment

noyb's comment:

The proposed exclusion of, inter alia, “commercially sensitive business knowledge” is contrary to CJEU case law which requires a balancing of interest even for information that is more protected than mere business knowledge.

#392 Recital 40

Authored by

Text proposed by the Commission

(40) Article 35 of that Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. The lists of processing operations should be prepared by the Board and adopted by the Commission as an implementing act. In order to facilitate compliance by controllers, the Board should also prepare a common template and a common methodology for conducting data protection impact assessments, to be adopted by the Commission as an implementing act. The Commission should take due account of the proposals prepared by the Board and review them, as necessary, prior to adoption. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary.

Amendment

(40) Article 35 of Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. The lists of processing operations should be prepared by the Board and adopted by the Commission as an implementing act. In order to facilitate compliance by controllers, the Board should also prepare a common template and a common methodology for conducting data protection impact assessments, to be adopted by the Commission as an implementing act. The Commission should take due account of the proposals prepared by the Board and review them, as necessary, prior to adoption. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary.

noyb's comment:

No material change to the Commission's proposal.

#394 Recital 40 a (new)

Authored by

Text proposed by the Commission

Amendment

(40a) Regulation (EU) 2016/679 follows a technology-neutral, risk-based and purpose-driven approach to the processing of personal data. The lawfulness of processing should be determined by reference to a specific and legitimate purpose and an assessment of the risks posed to the rights and freedoms of natural persons, taking into account the nature, scope, context and purposes of the processing. Where personal data are processed through the terminal equipment of natural persons, and the available indicators demonstrate that the likelihood and severity of risks to those rights and freedoms are limited, reliance on legal bases other than consent may be justified, where appropriate.

noyb's comment:

Allowing further legal bases for the processing through terminal equipment of natural persons would reduce the level of data protection.

#396 Recital 41

Authored by

Lena Düpont

Text proposed by the Commission

(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council¹⁶ applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council¹⁷ applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brough into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. _________________ ¹⁶ Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). ¹⁷ Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).

Amendment

(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council¹⁶ applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council¹⁷ applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brough into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. Any alignment brought to Directive (EU) 2016/680 by the amendments to Regulation (EU) 2016/679 shall not override the legitimate national and public security interests of Member States, as well as the legitimate internal security interests of the Union. _________________ ¹⁶ Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). ¹⁷ Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).

noyb's comment:

No real direct effect but just accounting for differences in LED and GDPR.

#398 Recital 41

Authored by

Text proposed by the Commission

(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council¹⁶ applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council¹⁷ applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brough into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. _________________ ¹⁶ Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). ¹⁷ Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).

Amendment

(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council¹⁶ applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council¹⁷ applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brought into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. _________________ ¹⁶ Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). ¹⁷ Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).

noyb's comment:

editorial correction

#401 Recital 43

Authored by

Lena Düpont

Text proposed by the Commission

Amendment

(43) In order to provide a strong and coherent data protection framework in the Union, the necessary adaptations of Directive (EU) 2016/680 and any other Union legal act applicable to such processing of personal data should follow after the adoption of this regulation, in order to allow for their application as close as possible to the entry into application of the amendments to Regulation (EU) 2016/679 and Regulation (EU) 2018/1725. Any following adaption of Directive (EU) 2016/680 should not impair the ability of competent authorities to process personal data collected in the context of the prevention, investigation, detection or prosecution of specific criminal offences in order to develop an understanding of criminal activities and to make links between different criminal offences detected. Moreover, any concurrent adaptation of Regulation (EU) 2018/1725 shall not impair the processing of personal data for the purpose of preventing threats to public security, internal security of Union institutions and bodies, or other important objectives of general public interest of the Union or of a Member State, in particular the objectives of the Common Foreign and Security Policy of the Union or an important economic or financial interest of the Union or of a Member State.

noyb's comment:

This proposal seems to signal that a general superiority of processing related to law enforcement over data protection. In particular regarding the aspects of “understanding of criminal activities and to make links between different criminal offences detected” which might refer to big data analysis based on criminal data, this seems like pushing for a reduction of the level of privacy.

#435 Recital 44 – paragraph 2

Authored by

Text proposed by the Commission

The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment should continue to be allowed only on the basis of consent. Similar to the approach in Directive 2002/58/EC, this requirement should not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, when that is based on Union or Member State law within the meaning of Article 6 of Regulation (EU) 2016/679 and if it fulfils all conditions of lawfulness laid down in that provision, and is done for the objectives laid down in Article 23(1) of Regulation (EU) 2016/679.

Amendment

The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment should continue to be allowed only on the basis of consent. Similar to the approach in Directive 2002/58/EC, this requirement should not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, when that is based on Union law within the meaning of Article 6 of Regulation (EU) 2016/679 and if it fulfils all conditions of lawfulness laid down in that provision, and is done for the objectives laid down in Article 23(1) of Regulation (EU) 2016/679.

noyb's comment:

Minimally improves the Commission proposal, but still relies on the devide between personal and non-personal cookies which brings about legal uncertainty.

Juan Ignacio Zoido Álvarez

#439 Recital 44 – paragraph 3

Authored by

Ana Miguel Pedro

Text proposed by the Commission

Amendment

With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. This list should include measuring the audience of an online service by creating aggregated information about the usage of an online service, where it is carried out by the provider of that online service, or by a third party, such as a market research company or a Joint Industry Committee, acting together with or on behalf of this provider. ‘Audience measurement’ should be understood in accordance with Article 2(16) and with Article 24(1) of Regulation (EU) 2024/1083. Gatekeepers designated under Regulation (EU) 2022/1925 carrying out audience measurement may not rely on article 88a(3)c of this Regulation. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. The controller, such as a media service provider, may mandate a processor, such as a market research company, to carry out the processing on its behalf.

noyb's comment:

Relies on further exceptions to the current legal framework.

#467 Recital 46

Authored by

Text proposed by the Commission

(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser or in the EU Digital Identity Wallet as set out by Regulation (EU) 914/2014, or any other adequate means. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, media service providers should not be obliged to respect the machine-readable indications of data subject’s choices. The obligation for providers of web browsers to provide the technical means for data subjects to make choices with respect to the processing should not undermine the possibility for media service providers to request consent by data subjects.

Amendment

noyb's comment:

Goes back beyond the Commission proposal. Tries to grant legislative powers to Media Service Providers?!

#943 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)

Authored by

Regulation (EU) 2016/679
Article 4 – point 1 – second part

Text proposed by the Commission

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

Amendment

Information relating to a natural person, is not personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. That assessment shall take into account objective factors, including but not limited to costs, time, available technology and the legal means available to that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

noyb's comment:

The amendment does not materially change the Commission's proposal, thus overall remains a decrease of protection compared to the current Article 4(1).

#948 Article 4 – point 15 (Article 3 – paragraph 1 – point 1 – point a)

Authored by

Regulation (EU) 2016/679
Article 4 – point 15

Text proposed by the Commission

Amendment

(15) ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status; Data that merely allow such information to be inferred indirectly shall not be considered data concerning health;

noyb's comment:

Lowering the protections for health data (e.g. person buying HIV medicine would not be covered anymore under Article 9 because the person could buy it for someone else).

#953 Article 4 – point 33 (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 33

Text proposed by the Commission

(33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply;

Amendment

(33) electronic communications networks’ means transmission systems as defined in of Article 2(1) of Directive (EU) 2018/1972;

#970 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 38

Text proposed by the Commission

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.

Amendment

(38) “scientific research” means creative and systematic work undertaken in order to increase the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts without any particular application or use in view, or through original investigation undertaken in order to acquire new knowledge directed primarily towards a specific, practical aim or objective. This does not exclude that the research may also aim to further a commercial interest.

noyb's comment:

Wider scope than current understanding. Mainly formal criteria. Not overly clear.

#971 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 38

Text proposed by the Commission

Amendment

noyb's comment:

like amendment 970

#1025 Article 9 – paragraph 2 – point k (Article 3 – paragraph 1 – point 3 – point a)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k

Text proposed by the Commission

(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.

Amendment

(k) incidental and residual processing in the context of the development, training, testing, deployment and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model as referred to in Regulation (EU) 2024/1689, including for the improvement of such systems or models and of related products or services, subject to the conditions referred to in paragraph 5.

noyb's comment:

This amendment proposes to add the terms incidental and residual to the article but adds the improvement of models or services in the proposed provision.

#1040 Article 9 – paragraph 2 – point la (new) (Article 3 – paragraph 1 – point 3 – point a)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 2 – point la (new)

Text proposed by the Commission

Amendment

(la) processing is strictly necessary for the recognition, management or payment of retirement, disability, dependency or other related pension benefits, where such processing is required by contract or legal provision governing the pension plan, for the sole purpose of verifying and administering the conditions for entitlement, and is subject to appropriate and specific safeguards to protect the fundamental rights and interests of the data subject, including data minimisation, purpose limitation, restricted access and professional secrecy. This provision shall not affect the validity of other legal bases currently relied upon under this Regulation for the processing of health data related to the treatment of certain pension benefits.

noyb's comment:

The amendment includes more derogations than the Commission's proposal.

#1043 Article 9 – paragraph 2 – point lb (new) (Article 3 – paragraph 1 – point 3 – point a)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 2 – point lb (new)

Text proposed by the Commission

Amendment

(lb) In Article 9, paragraph 2, the following point is added: 'lb. processing is necessary and proportionate for the prevention of fraud, the detection and prevention of abuse, bot and spam activity, identity misuse, account takeover or payment fraud, or for ensuring the security of accounts, payments and transactions, provided that the processing is subject to appropriate safeguards for the rights and freedoms of the data subject.'

noyb's comment:

The amendment includes more derogations than the Commission's proposal. Uncelar why Article 9 data would be necessary for these purposes.

#1045 Article 9 – paragraph 1 (Article 3 – paragraph 1 – point 3 – point a a (new))

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 1

Text proposed by the Commission

Amendment

(aa) Paragraph 1 of Article 9 is replaced by the following: Processing of personal data that directly reveals in relation to a specific data subject racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health relating to the physical or mental health status of a natural person, or data concerning a natural person's sex life or sexual orientation shall be prohibited.

noyb's comment:

Limitation of scope of Article 9 to information that only "directly" reveals such data.

#1057 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 5

Text proposed by the Commission

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

Amendment

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented, in accordance with Article 89 safeguards to limit the processing of special categories of personal data and to mitigate the risk associated with the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall ensure that such data are processed under one or more of the conditions referred to in paragraph 2, points a to j, or remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’

noyb's comment:

The amendment proposes to have a "fall-back" Article 9(2) legal basis for residual special categories of personal data which is a wider allowance than initially proposed by the Commission.

#1112 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)

Authored by

Regulation (EU) 2026/679
Article 13 – paragraph 4

Text proposed by the Commission

4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.

Amendment

4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information or where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.’

noyb's comment:

Small amendments to the Commission's proposal. Mainly clarififying that the proposal provides for an additional exemption. A lack of information typcially violates the "fairness" principle in Article 8(2) of the Charter.

#1123 Article 13 – paragraph 5 (Article 3 – paragraph 1 – point 6)

Authored by

Regulation (EU) 2016/679
Article 13 – paragraph 5

Text proposed by the Commission

5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.

Amendment

5. When the processing takes place for scientific research purposes, including scientific research in the public interest aiming to further a commercial interest, and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort, including cases where the change of purpose could not have been anticipated at the time of collection, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available. This scenario shall apply equally to the obligations under Article 14(5)(b).

noyb's comment:

This proposal builds upon the Commission's proposal, but even decreases the level of privacy in those cases. It may violate the purpose limitation and fairness principle in Article 8(2) of the Charter.

#1127 Article 14 – paragraph 5a (new) (Article 3 – paragraph 1 – point 6)

Authored by

Regulation (EU) 2016/679
Article 14 – paragraph 5a (new)

Text proposed by the Commission

Amendment

5a. In Article 14, paragraph 5a is added: '5a. The obligation to make information available pursuant to Article 14 shall be deemed fulfilled where such information is published and maintained in an easily accessible manner on the entity's website.'

noyb's comment:

This proposal provides for an easy (for controllers) way to provide the Article 14 information. However, data subjects would be unable to be aware of the processing of their data in numerous cases. In particular in case of Article 14 which applies when information is collected indirectly. Data subjects are therefore usually unaware. Sch a broad exemption is certainly not proportionate and therefore in violaution the fairness principle of Article 8(2) of the CFR.

#1129 Article 15 – paragraph 1 – last sentence (Article 3 – paragraph 1 – point 6 a (new))

Authored by

Regulation (EU) 2016/679
Article 15 – paragraph 1 – last sentence

Present text

1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) where the personal data are not collected from the data subject, any available information as to their source; (h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Amendment

6a. In Article 15, paragraph 1, the following sentence is added: "The right of access under this Article shall not extend to personal data which the data subject has created, authored, transmitted or received in the ordinary course of the relevant activity and which remain available to the data subject through the controller's systems or by other lawful means."

noyb's comment:

The amendment includes a derogation which is not foreseen in the current regime.Such a broad ecemption likely violates the "access" element in Article 8(2) of the Charter.

#1132 Article 13 – paragraph 4a (new) (Article 3 – paragraph 1 – point 6 a (new))

Authored by

Regulation (EU) 2016/679
Article 13 – paragraph 4a (new)

Text proposed by the Commission

Amendment

6a. In Article 13, paragraph 4a is added: '4a. The obligation to make information available pursuant to Article 13 shall be deemed fulfilled where such information is published and maintained in an easily accessible manner on the entity's website.'

noyb's comment:

This proposal provides for an easy (for controllers) way to provide the Article 13 information. However, data subjects would be unlikely to be aware of the processing of their data in some cases (e.g. the person may not know that his/her data is subject to a specific policy on some random website of a data broker). Such a broad exemption is not proportionate and therefore in violation of the "fairness" principle in Article 8(2) CFR. In particular, since it covers situation in which the data subject is unaware of the processing.

#1192 Article 33 – paragraph 6 (Article 3 – paragraph 1 – point 8 – point c)

Authored by

Regulation (EU) 2016/679
Article 33 – paragraph 6

Text proposed by the Commission

6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

Amendment

6. The Board shall establish and make public common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person and a list of the circumstances in which it is not likely to result in such a high risk.. The template and lists shall be available to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2). 7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6.’

noyb's comment:

This amendment, in particular, follows some considerations of the EDPB/EDPS opinion and adds the creation of a white-list the documents the Board shall establish, providing increased legal certainty.

#1209 Article 35 – paragraph 4 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 4

Text proposed by the Commission

4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

Amendment

4. The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

noyb's comment:

Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.

#1214 Article 35 – paragraph 5 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 5

Text proposed by the Commission

5. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.

Amendment

5. Processing operations not covered by the list in paragraph 4 shall not be subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

noyb's comment:

This template would reduce factually reduce the cases in which a controller would prepare a DPIA, resulting in a lower level of data protection but less administrative work for controllers.

#1217 Article 35 – paragraph 6 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 6

Text proposed by the Commission

6. The Board shall prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments.

Amendment

6. The Board shall establish a common template and a common methodology for conducting data protection impact assessments.

noyb's comment:

Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.

#1224 Article 35 – paragraph 6a (Article 3 – paragraph 1 – point 9 – point b)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 6a

Text proposed by the Commission

6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

Amendment

6a. The proposal for the list referred to in paragraph 4 and for the template and methodology referred to in paragraph within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2). That list shall be based on convergence area from national authorities and shall not introduce new categories of processing operations that go beyond existing obligations under this Regulation. Processing operations lawfully in place at the time of their initiation shall not be subject to a retroactive obligation to carry out a data protection impact assessment as a result of the adoption of the harmonised list.

noyb's comment:

This proposal (apparently subject to editorial mistakes) tries to narrow the scope of potential processing activities subject to a DPIA; therefore, it lowers the level of data protection. It also introduces some legal uncertainty, offsetting a potential reduction in administrative workload.

#1254 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 1

Text proposed by the Commission

(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.

Amendment

(1) The Commission may adopt implementing acts to specify technical and organisational measures and criteria supporting controllers in assessing whether data resulting from anonymisation or pseudonymisation no longer constitutes personal data for certain entities and in preventing the risk of re-identification.

noyb's comment:

The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1) and 4(6).

#1269 Article 41a – paragraph 2 – point a (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a

Text proposed by the Commission

(a) assess the state of the art of available techniques;

Amendment

(a) assess the state of the art of available techniques, such as privacy- enhancing technologies;

noyb's comment:

Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.

#1275 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b

Text proposed by the Commission

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.

Amendment

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data, taking into account objective factors such as cost, amount of time required, available technology, legal obligations.

noyb's comment:

#1281 Article 41a – paragraph 2 – point ba (new) (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 2 – point ba (new)

Text proposed by the Commission

Amendment

(ba) In Article 41a, paragraph 2, the following point ba is added: '(ba) assess technical, administrative, organisational and contractual measures that can prevent the risk of re-identification.'

noyb's comment:

Does not add anything material towards the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.

#1289 Article 41a – paragraph 3 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 3

Text proposed by the Commission

(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.

Amendment

(3) The implementation of the technical and organisational measures and criteria outlined in an implementing act may be used as an element to demonstrate that pseudonymised data do not lead to reidentification of the data subjects in a specific case.

noyb's comment:

#1302 Article 41b (new) (Article 3 – paragraph 1 – point 10 a (new))

Authored by

Regulation (EU) 2016/679
Article 41b (new)

Text proposed by the Commission

Amendment

10a. The following Article 41b is inserted: 'Article 41b Application of pseudonymisation and identification of a natural person (1) Controllers and processors may apply pseudonymisation, and anonymisation, or other Privacy Enhancing Technologies referred to in Article 25a to personal data in order to reduce the risks to the data subjects concerned and to help meet their obligations under this Regulation, in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information. To determine whether a natural person is identifiable, including through personal data having undergone pseudonymisation, account shall be taken of all the means reasonably likely to be used, such as singling out or online identifiers, either by the controller or by another person to identify the natural person directly or indirectly. (2) Paragraph 1 is without prejudice to other provisions and obligations applicable to the controller and processor, including under Chapter IV and V of this Regulation. (3) The Board shall issue an opinion, in accordance with Article 64(2) of this Regulation, addressing the application of pseudonymisation and anonymisation to personal data, including related technical and organisational measures, and specifying means and criteria to determine whether and when such may effectively prevent persons other than the controller from identifying a data subject, in such a way that, for them, the data subject is not or is no longer identifiable, and where information relating to the data subject no longer constitutes personal data for that person other than the controller. (4) The Chair of the Board shall request the opinion referred to in paragraph 3 no later than 6 months after the entry into force of this Regulation. The opinion shall be reviewed and updated where necessary. (5) The Commission may adopt implementing acts specifying technical and organisational criteria, methodologies and standards where necessary to ensure uniform conditions for the application of paragraphs 1 and 3, or where further clarity is required following the issuance of the opinion referred to in paragraph 3, The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).'

noyb's comment:

The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1) and Article 4(5).

#1311 Article 57 – paragraph 1 – subparagraph (Article 3 – paragraph 1 – point 11 – introductory part)

Authored by

Regulation (EU) 2016/679
Article 57 – paragraph 1 – subparagraph

Text proposed by the Commission

11. In Article 57(1) is amended as follows:

Amendment

11. In Article 57, paragraph 1 is amended as follows: In paragraph 1, the following subparagraph is added: 'National supervisory authorities shall refrain from adopting guidelines, recommendations and best practices on matters already covered by guidelines, recommendations and best practices issued by the Board and, where necessary, shall update or repeal their national documentation adopted prior to guidelines, recommendations and best practices adopted by the Board in order to ensure consistency of interpretation of this Regulation.'

noyb's comment:

The amendment pushes for harmonization.

#1312 Article 57 – paragraph 1 – point aa (new) (Article 3 – paragraph 1 – point 11 – point a a (new))

Authored by

Regulation (EU) 2016/679
Article 57 – paragraph 1 – point aa (new)

Text proposed by the Commission

Amendment

(aa) In Article 57, paragraph 1, the following point aa is inserted: '(aa) handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80 and investigate, in the case of a complaint by a data subject at its discretion, to the extent approriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisor authority is necessary;'

noyb's comment:

The amendment gives more discretion to supervisory authorities, which could lead to less complaint handling. The lack of a remedy (beyond civil courts) could violate Article 8(3) and 47 of the Charter.

#1314 Article 57 – paragraph 1 – va (Article 3 – paragraph 1 – point 11 – point a b (new))

Authored by

Regulation (EU) 2016/679
Article 57 – paragraph 1 – va

Text proposed by the Commission

Amendment

(ab) In Article 57, paragraph 1, the following point va is added: '(va) set up regulatory sandboxes to facilitate testing the compliance of specific techniques or technological solutions to be used for the data processing activities with the obligations under this Regulation or whether the data processing results in data that would be exempt from this Regulation.'

noyb's comment:

The amendment provides for compliance tools to be put in place by the supervisory authorities, ultimately shifting compliance to them. The fact that a full excemption from the Regulation is granted would undermine the rights under the GDPR.

#1326 Article 70 – paragraph 1 – point ha (Article 3 – paragraph 1 – point 14)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point ha

Text proposed by the Commission

Amendment

(ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment, pursuant to Article 35.

noyb's comment:

On its own, this amendment has no significant impact. Clear lists simplify the application of the law.

#1331 Article 70 – paragraph 1 – point hb (Article 3 – paragraph 1 – point 14)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hb

Text proposed by the Commission

(hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

Amendment

(hb) establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

noyb's comment:

This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.

#1336 Article 70 – paragraph 1 – point hc (Article 3 – paragraph 1 – point 14)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc

Text proposed by the Commission

(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

Amendment

(hc) establish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

noyb's comment:

This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.

#1370 Article 88a – paragraph 1 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 1

Text proposed by the Commission

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.

Amendment

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject, and any subsequent processing necessary to achieve the purpose for which the data subject has given consent is only allowed when that person has given his or her consent, in accordance with this Regulation.

noyb's comment:

Unclear versus the current situation with the ePrivacy Directive given the confusing terminology, better than the Commission proposal.

Juan Ignacio Zoido Álvarez

#1379 Article 88a – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Ana Miguel Pedro

Regulation (EU) 2016/679
Article 88a – paragraph 2

Text proposed by the Commission

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).

Amendment

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).

noyb's comment:

Linguistic change to aling with GDPR.

#1383 Article 88a – paragraph 3 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3

Text proposed by the Commission

(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:

Amendment

(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:

noyb's comment:

Minor changes to the Commission version.

#1387 Article 88a – paragraph 3 – point b (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point b

Text proposed by the Commission

(b) providing a service explicitly requested by the data subject;

Amendment

(b) providing a service or the maintenance of a user session explicitly requested by the data subject;

noyb's comment:

Broadens the exception and does not provide additional legal certainty, given that a user session can be used for many different purposes (from necessary elements to ads).

#1394 Article 88a – paragraph 3 – point c (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c

Text proposed by the Commission

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;

Amendment

(c) (c) creating information about the usage of an online service to measure the audience of such a service, where it is carried out at the direction of the controller of that online service, or by a third party acting on behalf of the controller;

noyb's comment:

Broadens the new exception proposed.

#1397 Article 88a – paragraph 3 – point ca (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point ca (new)

Text proposed by the Commission

Amendment

(ca) In Article 83, paragraph 3, the following point ca is inserted: '(ca) performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083.'

noyb's comment:

New exception to the rule. Also, wronlgy refers to Article 83 instead of 88.

#1405 Article 88a – paragraph 3 – point da (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)

Text proposed by the Commission

Amendment

(da) In Article 88a, paragraph 3, the following point da is added: '(da) ‘legitimate interests’ according to Article 6(1)(f) of this regulation provided that the controller applies Privacy Enhancing Technologies (PETs) in accordance with the technical standards adopted pursuant to Article 25a. This point shall not apply to processing operations that involve tracking or profiling a data subject's behaviour for the purposes of behavioural advertising, where the advertising itself is directly generating revenue for the controller, or where there is no direct relationship with the data subject.'

noyb's comment:

New exception introduced. Very vague, mixing different concepts (personal data, legitimate interest and PETs).

#1406 Article 88a – paragraph 3 – point da (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)

Text proposed by the Commission

Amendment

(da) In Article 88a, paragraph 3, the following point da is added: '(da) legitimate purposes in relation to contextual advertising, including measuring the performance and reach of such advertisement or capping the frequency with which such advertisement is being displayed.'

noyb's comment:

New exception introduced.

#1410 Article 88a – paragraph 3 – point db (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point db

Text proposed by the Commission

Amendment

(db) In Article 88a, paragraph 3, the following point db is added: '(db) ‘legitimate interests’ according to Article 6(1)(f) of this regulation provided that the controller applies Privacy Enhancing Technologies (PETs) in accordance with the technical standards adopted pursuant to Article 25a. This point shall not apply to processing operations that involve tracking or profiling a data subject's behaviour for the purposes of behavioural advertising, regardless of whether there is a direct relationship with the data subject. This does not preclude the processing of data for internal product optimisation, provided such processing is not used to track the user.'

noyb's comment:

New exception introduced. Very vague, mixing different concepts (personal data, legitimate interest and PETs).

#1412 Article 88a – paragraph 3 – point db (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point db (new)

Text proposed by the Commission

Amendment

(db) In Article 88a, paragraph 3, the following point db is added: '(db) performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083.'

noyb's comment:

New exception proposed.

#1424 Article 88a – paragraph 4 – introductory sentence (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4 – introductory sentence

Text proposed by the Commission

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:

Amendment

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject is based on consent, the following shall apply:

noyb's comment:

Minor change

#1427 Article 88a – paragraph 4 – point a (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4 – point a

Text proposed by the Commission

(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

Amendment

(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner, or be presented with the option to decline consent and proceed to a paid alternative; 

noyb's comment:

Makes the refusal of consent dependent on a payment.

#1436 Article 88a – paragraph 4 – point c (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c

Text proposed by the Commission

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.

Amendment

(c) Where data subject refuse request for consent presented by media service providers, Media service providers shall be able to offer data subjects an equivalent alternative that is not accompanied by the processing of personal data for audience-based advertising purposes, where appropriate for a reasonable fee.

noyb's comment:

Limits the proposal of the Commission to media service providers and rewrites it to introduce payment for refusing consent, but is unclear about the details. Questionable from an equality before the law perspective.

#1455 Article 88b – title (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – title

Text proposed by the Commission

Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

Amendment

Voluntary automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

noyb's comment:

Significantly weakens the positive Commission proposal. A voluntary system would be chaotic and hardly functioning (see "DNT").

#1505 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 3

Text proposed by the Commission

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.

Amendment

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service. This exemption extends to all processing carried out by or on behalf of a media service provider in connection with the provision of the media service.

noyb's comment:

Broadens the exception.

#1506 Article 88b – paragraph 3a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 3a (new)

Text proposed by the Commission

Amendment

(3a) In Article 88b, the following paragraph is inserted: '3a. Where a data subject gives specific consent to a controller pursuant to Article 88a, such consent shall prevail over any conflicting automated or machine-readable indication referred to in paragraph 1.'

noyb's comment:

Makes automated signals meaningless as common cookie banners would override them.

#1513 Article 88b – paragraph 4 – first subparagraph (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph

Text proposed by the Commission

Amendment

The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. The European standardisation organisations shall, where appropriate, take into account existing international standards developed by international standardisation organisations, as well as emerging technical specifications developed by relevant industry consortia. When drawing up the standardisation mandate, the Commission shall consult the European Data Protection Board and an advisory forum comprising representatives of controllers, data subjects, media service providers, consumer protection organisations, academia and civil society to ensure that standards reflect diverse perspectives and do not create new gatekeepers

noyb's comment:

Positive approach, but should not only rely on specifications developed by industry consortia.

#1536 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 6

Text proposed by the Commission

(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.

Amendment

(6) Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces that provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article ,and shall provide the technical means to allow media service providers to effectively use the exception pursuant to paragraph 3, as applied pursuant to paragraphs 2 to 5 of this article. The technical means should allow for granular choices, including category-based or purpose-based preferences, and shall enable data subjects to override global settings at the service level.

noyb's comment:

Removes the obligation for providing the technical options.

#1549 Article 88b – paragraph 7a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 7a (new)

Text proposed by the Commission

Amendment

(7a) In Article 88b, the following paragraph is added: '7a. The Commission shall, by [insert date = 3 years after the date of entry into force of this Regulation], submit a report to the European Parliament and the Council on the functioning of this Article, including an assessment of: (a) the impact on user choice and competition; (b) the effectiveness of machine-readable indications in reducing consent fatigue; (c) the emergence of new gatekeeper risks; (d) the impact on European media service providers; and (e) the need for legislative amendment.'

noyb's comment:

Reporting duties of the Commission.

#1550 Article 88b – paragraph 7a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 7a (new)

Text proposed by the Commission

Amendment

(7a) In Article 88b, the following paragrpah is added: '7a. The Commission shall, by [insert date = 3 years after the date of entry into force of this Regulation], submit a report to the European Parliament and the Council on the functioning of this Article, including an assessment of: (a) the impact on user choice and competition; (b) the effectiveness of machine-readable indications in reducing consent fatigue; (c) the emergence of new gatekeeper risks; (d) the impact on European media service providers; and (e) the need for legislative amendment.'

noyb's comment:

Reporting duties of the Commission.

#1561 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 1

Text proposed by the Commission

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Amendment

Where the processing of personal data is necessary for the interests of the controller, or a third party, in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, including a general-purpose AI model as defined in Article 3, point (63) of Regulation (E) 2024/1689, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of this Regulation except where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child and except where other Union explicitly require consent. The processing of personal data in the context of the development and operation of an AI system may also be based for the performance of a task carried out by public authorities in the public interest pursuant to Article 6, paragraph 1, point (e) and paragraph 2.

noyb's comment:

The amendment rephrases the Commission's proposal.

#1562 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 1

Text proposed by the Commission

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Amendment

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of this Regulation, except where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child and where other Union laws explicitly require consent. The processing of personal data in the context of the development and operation of an AI system may also be based for the performance of a task carried out by public authorities in the public interest pursuant to Article 6, paragraph 1, point (e) and paragraph 2.

noyb's comment:

The amendment rephrases the Commission's proposal.

#1587 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 2

Text proposed by the Commission

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.

Amendment

Any such processing shall be subject to appropriate organisational, technical and legal measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects.

noyb's comment:

The amendment pushes against the right to object in proposed Article 88c.

#1589 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 2

Text proposed by the Commission

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.

Amendment

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with a right to object to the processing of their personal data.

noyb's comment:

The amendment pushes against an unconditional right to object.

#1721 Article 5 – paragraph 3 (Article 5 – paragraph 1 – point 2 – introductory part)

Authored by

Directive 2002/58/EC
Article 5 – paragraph 3

Text proposed by the Commission

2. After Article 5(3), the following subparagraph is added:

Amendment

2. Article 5(3) is deleted.

Justification

The AM removes overlapping ePrivacy rules on security, terminal access, metadata, location data and direct marketing where personal-data processing is already governed by the GDPR. Keeping parallel regimes creates consent fatigue, divergent national transpositions and legal uncertainty, including stricter rules for some anonymous device data than for personal data. Consolidation under the GDPR’s risk-based framework simplifies compliance, strengthens coherent rights exercise, supports innovation and preserves sector-specific rules in dedicated instruments.

noyb's comment:

Removes the ePrivacy protection. The GDPR currently does not provide for the same protection.

#1730 Article 5 – paragraph 3 – subparagraph 2 (new) (Article 5 – paragraph 1 – point 2)

Authored by

Directive 2002/58/EC
Article 5 – paragraph 3 – subparagraph 2 (new)

Text proposed by the Commission

This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.

Amendment

The processing of personal data previously governed by these provisions shall be exclusively subject to Regulation (EU) 2016/679. (It applies to overall directive.)

Justification

noyb's comment:

Removes ePrivacy Protection and is limited to personal data, while the ePrivacy Protectin offered broader protection.

#1732 Article 6 (Article 5 – paragraph 1 – point 2 a (new))

Authored by

Directive 2002/58/EC
Article 6

Text proposed by the Commission

Amendment

2a. Article 6 is deleted.

Justification

noyb's comment:

Removes ePrivacy Protection to reintroduce them in GDPR.

#1733 Article 9 (Article 5 – paragraph 1 – point 2 b (new))

Authored by

Directive 2002/58/EC
Article 9

Text proposed by the Commission

Amendment

2b. Article 9 is deleted.

Justification

noyb's comment:

Removes ePrivacy Protection to reintroduce them in GDPR.

#1735 Article 13 (Article 5 – paragraph 1 – point 2 c (new))

Authored by

Directive 2002/58/EC
Article 13

Text proposed by the Commission

Amendment

2c. Article 13 is deleted.

Justification

noyb's comment:

Removes ePrivacy Protection to reintroduce them in GDPR.