13 GDPR-relevant amendments by Alexandra Mehnert
#305 Recital 33
Text proposed by the Commission
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.Amendment
(33) The development, training, testing, validation, deployment, operation and monitoring of AI systems and AI models may require the processing of personal data. Such processing may constitute a legitimate interest of the controller or a third party within the meaning of Article 6(1), point (f), where appropriate, provided that the interests or fundamental rights and freedoms of the data subject do not override that interest, taking particular account of whether the data subject is a child. Where public authorities process personal data for the performance of a task carried out in the public interest or in the exercise of official authority vested in them, Article 6(1), point (e), in conjunction with Union or Member State law referred to in Article 6(3), should remain the appropriate legal basis. Controllers should use non-personal or anonymised data where the intended purpose can reasonably and effectively be achieved by using such data. Where the processing of personal data is necessary, pseudonymised data should be used wherever the intended purpose can reasonably and effectively be achieved by using such data. Appropriate technical and organisational measures should be implemented throughout the lifecycle of the AI system or AI model. Such measures should include data minimisation during the selection of sources and the training, testing and validation of the system or model, the use of state-of-the-art privacy-enhancing technologies, and measures to prevent memorisation, regurgitation, data leakage and the unauthorised disclosure of personal data through outputs. Personal data should only be included in an output where this is necessary for the intended purpose, the recipient is authorised to receive those data and the disclosure has a legal basis under Article 6 and, where applicable, Article 9. Particular protection should be afforded to special categories of personal data referred to in Article 9(1).
noyb's comment:
This proposed amendment does not go far beyond the Omnibus proposal. It allows the new limitation to the GDPR and only repeats existing requirements (mainly implementations of data minimization) as safeguards.
#347 Recital 36 a (new)
Authored by
Text proposed by the Commission
Amendment
(36a) To reduce administrative burdens for civil-society and volunteer-based organisations, associations and non-profit entities should not be subject to the full scope of the regulation and in particular not of information and record-keeping obligations of Regulation 2016/679, provided their data processing is limited to low-risk internal administrative purposes and does not involve systematic monitoring or high-risk operations. Member States should ensure that such entities can fulfil transparency obligations through general public information rather than individual notices
noyb's comment:
Reducing the scope for certain organisations simplifies GDPR compliance for those organisations while reducing the level of data protection. E.g. certain data subjects would not be informed about the processing of their data.
#1106 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)
Regulation (EU) 2016/679
Article 13 – paragraph 4
Text proposed by the Commission
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.Amendment
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, or where the provision of such information proves impossible or would involve a disproportionate effort, taking into account the nature, scope, context and purposes of the processing, the size and resources of the controller, and the risk to the rights and freedoms of natural persons, unless the controller transmits the data to other recipients or categories of recipients for purposes other than those directly related to the clear and circumscribed relationship with the data subject, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35. In such cases, the controller shall take appropriate measures to protect the rights and freedoms and legitimate interests of the data subject, including, where appropriate, making the information publicly available in an easily accessible form.Justification
Information obligations are essential for transparency, but they should remain proportionate and workable in low-risk situations. The Commission proposal rightly introduces an exemption for clear and circumscribed relationships where the controller does not carry out data-intensive activities. However, the exemption should also cover situations where individual information proves impossible or would involve a disproportionate effort, provided that appropriate safeguards are maintained. In addition, the mere transmission of data to recipients should not automatically exclude the exemption where such transmission is directly related to the existing relationship with the data subject, for example in the context of associations, non-profit organisations, craft businesses or small enterprises. This amendment preserves transparency while reducing unnecessary administrative burdens.
noyb's comment:
Building upon the Commission’s proposal, this amendment similarly allows for further cases where no information to data subjects is provided (and goes even further). As does the Com proposal, this provision is overly complex and almost unworkable in practise. A lack of information typcially violates the "fairness" principle in Article 8(2) of the Charter.
#1128 Article 13 – paragraph 4a (new) (Article 3 – paragraph 1 – point 6 a (new))
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 4a (new)
Present text
Article 13 Information to be provided where personal data are collected from the data subject 1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: (a) the identity and the contact details of the controller and, where applicable, of the controller's representative; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; (e) the recipients or categories of recipients of the personal data, if any; (f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available. 2. In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability; (c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (d) the right to lodge a complaint with a supervisory authority; (e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; (f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. 3. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2. 4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.Amendment
6a. In Article 13, paragraph 4a is added: "Paragraphs 1 to 4 shall not apply to associations, foundations, and other non-profit organisations established in the Union, provided that: (a) the processing of personal data is limited to the administration of membership, volunteers, donors, or beneficiaries; (b) such processing is not likely to result in a high risk to the rights and freedoms of natural persons; and (c) the data are not shared with third parties for commercial purposes."Justification
Article 13 information obligations are essential for transparency, but they can create disproportionate administrative burdens for small non-profit organisations where the processing relationship is clear, direct and limited to internal administrative purposes. Associations, foundations and other non-profit organisations should therefore be allowed to fulfil transparency obligations through publicly accessible information where processing is limited to members, volunteers, donors or beneficiaries, does not involve systematic monitoring, is not likely to result in a high risk and is not used for commercial third-party sharing. This targeted clarification supports civic engagement and volunteer work while preserving the substance of the right to information.
noyb's comment:
This proposal adds an exemption from the information obligation similar to the Commission's proposal but limited in its scope. Unlike the Commission's proposal, this version is much clearer and the added legal uncertainty is probably lower than the administrative simplification. Such a broad ecemption of information duties likely violates the "fairness" principle in Article 8(2) of the Charter.
#1563 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)
Regulation (EU) 2016/679
Article 88c – paragraph 1
Text proposed by the Commission
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Amendment
1) Where the processing of personal data is necessary for the purposes of the development, training, testing, validation, deployment, operation or monitoring of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or of an AI model, such processing may constitute a legitimate interest within the meaning of Article 6(1), point (f), provided that: (a) the processing is necessary for the interest pursued by the controller or by a third party; (b) that interest is not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, taking particular account of whether the data subject is a child; and (c) no provision of Union or Member State law expressly requires the consent of the data subject for that processing.
noyb's comment:
The provision repeats the existing Article 6(1)(f) GDPR, without adding safeguards.
#1579 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)
Regulation (EU) 2016/679
Article 88c – paragraph 2
Text proposed by the Commission
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.Amendment
2) Where the task or official authority of a public authority or body is laid down by Union or Member State law in accordance with Article 6(3), personal data may be further processed for the purposes referred to in paragraph 1 on the basis of Article 6(1), point (e), where: (a) the development or use of the AI system or AI model serves the performance of that task or the exercise of that official authority; (b) the purpose pursued cannot be effectively achieved by processing non-personal or anonymised data; and (c) the processing is necessary and proportionate to the public interest objective pursued. This paragraph shall not confer any new task or official authority on a public authority or body. 3) Controllers shall use non-personal or anonymised data where the purpose of the processing can reasonably and effectively be achieved by using such data.Where the use of personal data is necessary, controllers shall use pseudonymised data wherever the purpose can reasonably and effectively be achieved by using such data. 4) Processing pursuant to paragraphs 1 and 2 shall be subject to appropriate technical and organisational measures and safeguards for the rights and freedoms of data subjects. Those measures shall include, as appropriate: (a) ensuring data minimisation during the selection of data sources and throughout the training, testing, validation, deployment and operation of the AI system or AI model; (b) limiting the processing to data that are adequate, relevant and necessary for the intended purpose; (c) applying state-of-the-art privacy-enhancing technologies, including pseudonymisation, where appropriate; (d) testing, monitoring and mitigating the risks of memorisation, regurgitation, data leakage, inference and unauthorised disclosure; (e) effectively preventing personal data retained or memorised in the AI system or AI model from being used to generate outputs which disclose or otherwise make those data available to persons not authorised to receive them; (f) ensuring that personal data are included in an output only where such inclusion is necessary for the intended purpose, the recipient is authorised to receive the data and the disclosure has a legal basis under Article 6 and, where applicable, Article 9; (g) providing appropriate transparency to data subjects; and (h) facilitating the exercise of the rights of data subjects under this Regulation. 5) Where the controller cannot effectively prevent the unauthorised disclosure of personal data through the output of the AI system or AI model, the controller shall not deploy or operate that system or model in a manner that enables such disclosure. 6) The processing of special categories of personal data shall be permitted only where one of the conditions laid down in Article 9(2) is fulfilled. Where point (k) of Article 9(2) applies, the conditions and safeguards laid down in Article 9(5) shall apply. 7) Paragraphs 1 to 6 shall be without prejudice to the other provisions of this Regulation, Regulation (EU) 2024/1689 and other applicable Union or Member State law.
noyb's comment:
The proposal allows for "further processing", usually understood as processing beyond the original purpose. While there is a long list of requirements, it is unclear why they would only apply to public tasks.
#1599 Article 14 – paragraph 5a (new) (Article 3 – paragraph 1 a (new))
Authored by
Regulation (EU) 2016/679
Article 14 – paragraph 5a (new)
Present text
Article 14 Information to be provided where personal data have not been obtained from the data subject 1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information: (a) the identity and the contact details of the controller and, where applicable, of the controller's representative; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) the categories of personal data concerned; (e) the recipients or categories of recipients of the personal data, if any; (f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available. 2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; (c) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability; (d) where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (e) the right to lodge a complaint with a supervisory authority; (f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources; (g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. The controller shall provide the information referred to in para graphs 1 and 2: (a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circum stances in which the personal data are processed; (b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or (c) if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed. 4. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2. 5. Paragraphs 1 to 4 shall not apply where and insofar as: (a) the data subject already has the information; (b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available; (c) obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject's legitimate interests; or (d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.Amendment
In Article 14, paragraph 5a is added: "'5a. Where the controller is an association, foundation, or other non-profit organisation, and the personal data have not been obtained from the data subject, paragraphs 1 to 5 shall not apply where providing the information would require a disproportionate effort and the processing is limited to the internal purposes described in Article 13(6). In such cases, the controller shall adopt appropriate transparency measures.'"Justification
Non-profit organisations may receive personal data indirectly in the context of volunteer coordination, beneficiary support, charitable activities or membership-related administration. In such situations, providing individual information notices to each data subject can require disproportionate effort, particularly for small or volunteer-based organisations. This amendment allows proportionate transparency measures, such as public notices or online publication, where the processing remains limited to low-risk internal purposes. It preserves transparency while avoiding unnecessary bureaucracy for civil-society organisations.
noyb's comment:
The amendment includes a derogation which is not foreseen in the current regime.
#1600 Article 30 – paragraph 5a (new) (Article 3 – paragraph 1 b (new))
Authored by
Regulation (EU) 2016/679
Article 30 – paragraph 5a (new)
Present text
Article 30 Records of processing activities 1. Each controller and, where applicable, the controller's represen tative, shall maintain a record of processing activities under its respon sibility. That record shall contain all of the following information: (a) the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer; (b) the purposes of the processing; (c) a description of the categories of data subjects and of the categories of personal data; (d) the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or inter national organisations; (e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the docu mentation of suitable safeguards; (f) where possible, the envisaged time limits for erasure of the different categories of data; (g) where possible, a general description of the technical and organisa tional security measures referred to in Article 32(1). 2. Each processor and, where applicable, the processor's representa tive shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing: (a) the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller's or the processor's represen tative, and the data protection officer; (b) the categories of processing carried out on behalf of each controller; (c) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the docu mentation of suitable safeguards; B (d) where possible, a general description of the technical and organisa tional security measures referred to in Article 32(1). 3. The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form. 4. The controller or the processor and, where applicable, the controller's or the processor's representative, shall make the record available to the supervisory authority on request. 5. The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.Amendment
In Article 30, paragraph 5a is added "'5a. Paragraphs 1-4 shall not apply to associations, foundations, and other non-profit organisations whose processing activities are limited to the purposes described in Article 13(6).'"Justification
Record-keeping obligations under Article 30 should be proportionate to the actual risk of the processing activity. Small non-profit organisations, associations and foundations often lack dedicated compliance structures and process data only for limited internal administrative purposes. Requiring full records of processing activities in such low-risk cases creates administrative burdens without a corresponding benefit for data subjects. This amendment clarifies that the exemption applies to non-profit organisations where processing is limited to the purposes set out in Article 13(6), while preserving the full obligation where processing is likely to result in a high risk to the rights and freedoms of data subjects.
noyb's comment:
While this amendment aims to add a new paragraph, it – apparently incorrectly – shows a deletion of the existing Article 30(1) GDPR. Not taking this into account, the reduction of the scope of Article 30 for certain organisations would – for them – reduce their administrative workload.
#1601 Article 2 – paragraph 2 – point e (new) (Article 3 – paragraph 1 c (new))
Authored by
Regulation (EU) 2016/679
Article 2 – paragraph 2 – point e (new)
Present text
2. This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity;Amendment
In Article 2, the following point e is added: "'(e) by associations, foundations and other non-profit organisations established in the Union, where the processing is carried out solely in the course of their statutory non-commercial activities and is limited to the administration of members, former members, volunteers, donors or beneficiaries, provided that such processing does not involve systematic monitoring or processing likely to result in a high risk to the rights and freedoms of natural persons within the meaning of Article 35, and that the personal data are not disclosed to third parties for commercial purposes.'"Justification
Associations, foundations and other non-profit organisations generally process personal data within clear, direct and non-commercial relationships with their members, volunteers, donors or beneficiaries. Subjecting such limited and low-risk processing to the full scope of Regulation (EU) 2016/679 places a disproportionate administrative burden on civil-society and volunteer-based organisations, many of which lack dedicated compliance structures. This targeted exclusion complements the specific simplifications proposed for Articles 13, 14 and 30, while preserving the application of the Regulation to systematic monitoring, automated decision-making, high-risk processing and the commercial disclosure of personal data.
noyb's comment:
The amendment reduces protection by limiting the scope of the GDPR but with that simplifying compliance for the affected controllers. At the same time cooperation with controllers covered by the GDPR will likely be more complicated.
#1602 Article 9 – paragraph 2 – point k (new) (Article 3 – paragraph 1 d (new))
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k (new)
Present text
2. Paragraph 1 shall not apply if one of the following applies: (a)the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject; (b)processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject; (c)processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; (d)processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;(e)processing relates to personal data which are manifestly made public by the data subject;(f)processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity; (g)processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; (h)processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3; (i)processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;Amendment
In Article 9, paragraph 2 the following point k is added: "'(ja) processing is strictly necessary for the anonymisation of personal data pursuant to Article 6(3a), provided that the processing is subject to appropriate technical and organisational safeguards, that the data are not used to take measures or decisions concerning individual data subjects and that identifiable data are erased or rendered inaccessible as soon as they are no longer necessary for the anonymisation process.'"
#1603 Article 80 (Article 3 a (new))
Authored by
Regulation (EU) 2016/679
Article 80
Present text
Article 80 Representation of data subjects 1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.Amendment
Article 3 a (new) Article 80 is deleted. ""
noyb's comment:
The amendment removes the right for data subjects to mandate a representative.
#1604 Article 6 – paragraph 3a (new) (Article 3 b (new))
Authored by
Regulation (EU) 2016/679
Article 6 – paragraph 3a (new)
Present text
3. The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:(a)Union law; orAmendment
Article 3 b (new) In Article 6, the following paragraph 3a is inserted: "3a. Further processing of personal data for the sole purpose of anonymising those data shall be considered compatible with the purposes for which the personal data were initially collected and shall be lawful on the basis applicable to the initial processing."
noyb's comment:
This amendment allows controllers a derogation to anonymise data by claiming legitimate interest as a legal basis. This amendment can be beneficial for both controllers and data subjects.
#1605 Article 4 – point 5a (new) (Article 3 c (new))
Authored by
Regulation (EU) 2016/679
Article 4 – point 5a (new)
Present text
Article 4Definitions For the purposes of this Regulation: (1)‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; (2)‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; (3)‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future; (4)‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;Amendment
Article 3 c (new) In Article 4, the following point 5a is inserted "'(5a) “anonymisation” means the processing of personal data in such a manner that the resulting information does not or no longer constitute personal data for the controller or recipient concerned because the natural person to whom the information relates cannot be identified by means reasonably likely to be used by that controller or recipient, taking into account all objective factors and the means and criteria referred to in Article 41a;'"
noyb's comment:
(Full) anonymization can be good approahc. However, the Amendment now defines "relative" anonymization (conroller or a recipient). It also grants the power to determine the application of the GDPR to the Commission, which could violate Article 8(3) of the Charter.