77 GDPR-relevant amendments by Elena Sancho Murillo
#86 Recital 3
Authored by
Text proposed by the Commission
(3) Union digital legislation has evolved incrementally over the past years, in response to the rapidly growing footprint of digital technologies in the Union’s economy and societal dynamic, and in view of addressing emerging challenges and promoting business opportunities in the EU. Notwithstanding the Commission’s commitment to a systematic ‘stress test’ of the digital rules, along with other Union rules, which might lead to further regulatory adjustments notably following the forthcoming Digital Fitness Check, as well as other targeted evaluations of digital rules, immediate regulatory changes are necessary. Consequently, this Regulation proposes a first set of amendments to the digital legislative framework, aimed at providing immediate regulatory clarifications that stimulate innovation in the Union market, and that cut administrative compliance costs in particular for businesses, while also streamlining supervisory and administrative costs for supervisory authorities and advisory bodies. The amendments also seek to provide clarity to individuals.Amendment
(3) Union digital legislation has evolved incrementally over the past years, in response to the rapidly growing footprint of digital technologies in the Union’s economy and societal dynamic, and in view of addressing emerging challenges and promoting business opportunities in the EU. Notwithstanding the Commission’s commitment to its duties as a Guardian of the Treaties, to a high level of consumer protection, fundamental rights and freedoms, the Commission proposed regulatory changes aimed at providing regulatory clarifications for businesses, while also streamlining supervisory and administrative costs for supervisory authorities and advisory bodies. This Regulation also seeks to provide clarity and maintain the highest standard of protections for individuals.
noyb's comment:
Highlighting rights over innovation, which can be relevant for later interpretation of the law. However, not any significant impact.
#92 Recital 3
Authored by
Text proposed by the Commission
(3) Union digital legislation has evolved incrementally over the past years, in response to the rapidly growing footprint of digital technologies in the Union’s economy and societal dynamic, and in view of addressing emerging challenges and promoting business opportunities in the EU. Notwithstanding the Commission’s commitment to a systematic ‘stress test’ of the digital rules, along with other Union rules, which might lead to further regulatory adjustments notably following the forthcoming Digital Fitness Check, as well as other targeted evaluations of digital rules, immediate regulatory changes are necessary. Consequently, this Regulation proposes a first set of amendments to the digital legislative framework, aimed at providing immediate regulatory clarifications that stimulate innovation in the Union market, and that cut administrative compliance costs in particular for businesses, while also streamlining supervisory and administrative costs for supervisory authorities and advisory bodies. The amendments also seek to provide clarity to individuals.Amendment
(3) Union digital legislation has evolved incrementally over the past years, in response to the rapidly growing footprint of digital technologies in the Union’s economy and societal dynamic, and in view of addressing emerging challenges and promoting business opportunities in the EU. Notwithstanding the Commission’s commitment to a systematic ‘stress test’ of the digital rules, along with other Union rules, which might lead to further regulatory adjustments notably following the forthcoming Digital Fitness Check, as well as other targeted evaluations of digital rules, immediate regulatory changes are necessary. Consequently, this Regulation proposes a first set of amendments to the digital legislative framework, aimed at providing immediate regulatory clarifications that stimulate innovation in the Union market, and that cut administrative compliance costs in particular for businesses, while also streamlining supervisory and administrative costs for supervisory authorities and advisory bodies. The amendments seek to provide clarity to individuals and safeguard the protection of privacy and personal data.
noyb's comment:
Highlighting the right to data protection. Can have an impact on future interpretation, but no direct impact on the law.
#93 Recital 3
Authored by
Text proposed by the Commission
(3) Union digital legislation has evolved incrementally over the past years, in response to the rapidly growing footprint of digital technologies in the Union’s economy and societal dynamic, and in view of addressing emerging challenges and promoting business opportunities in the EU. Notwithstanding the Commission’s commitment to a systematic ‘stress test’ of the digital rules, along with other Union rules, which might lead to further regulatory adjustments notably following the forthcoming Digital Fitness Check, as well as other targeted evaluations of digital rules, immediate regulatory changes are necessary. Consequently, this Regulation proposes a first set of amendments to the digital legislative framework, aimed at providing immediate regulatory clarifications that stimulate innovation in the Union market, and that cut administrative compliance costs in particular for businesses, while also streamlining supervisory and administrative costs for supervisory authorities and advisory bodies. The amendments also seek to provide clarity to individuals.Amendment
(3) Union digital legislation has evolved incrementally over the past years, in response to the rapidly growing footprint of digital technologies in the Union’s economy and societal dynamic, and in view of addressing emerging challenges and promoting business opportunities in the EU. Notwithstanding the Commission’s commitment to a systematic ‘stress test’ of the digital rules, along with other Union rules, which might lead to further regulatory adjustments notably following the forthcoming Digital Fitness Check, as well as other targeted evaluations of digital rules, immediate regulatory changes are necessary. Consequently, this Regulation proposes a first set of amendments to the digital legislative framework, aimed at providing immediate regulatory clarifications that stimulate innovation in the Union market, and that cut administrative compliance costs in particular for businesses, while also streamlining supervisory and administrative costs for supervisory authorities and advisory bodies. The amendments also seeks to provide clarity and to mainain the highest standard of protection for individuals.
noyb's comment:
Highlighting the right to data protection. Can have an impact on future interpretation, but no direct impact on the law.
#98 Recital 4
Authored by
Text proposed by the Commission
(4) Given the foundational role of data in driving value-creation in the digital economy, and pursuant to the objectives of the Communication for a European Data Union Strategy, the amendments presented in this Regulation to the legislative framework regarding data seek to build a coherent and cohesive regulatory framework for the availability and use of data, streamlining and consolidating the data regulatory framework into only two legal acts, namely Regulations (EU) 2016/6795 and (EU) 2023/28546 of the European Parliament and of the Council, from currently five different applicable acts. The amendments seek to cut unnecessary administrative costs and stimulate the availability of data as a prerequisite for supporting competitive digital businesses in the Union, while maintaining the highest standard of protections for privacy, personal data protection, and fair business practices, and ensuring core regulatory objectives, including compliance with EU and national competition law. _________________ 5 REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) 6 REGULATION (EU) 2023/2854 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act)Amendment
(4) Given the foundational role of legally processed data in driving value-creation in the digital economy, and pursuant to the objectives of the Communication for a European Data Union Strategy, the amendments presented in this Regulation to the legislative framework regarding data seek to build a coherent and cohesive regulatory framework for the availability and use of data, streamlining and consolidating the data regulatory framework into only two legal acts, namely Regulations (EU) 2016/6795 and (EU) 2023/28546 of the European Parliament and of the Council, from currently five different applicable acts. The amendments seek to cut unnecessary administrative costs and stimulate the availability of data as a prerequisite for supporting competitive digital businesses in the Union, while maintaining the highest standard of protections for privacy, personal data protection, and fair business practices, and ensuring core regulatory objectives, including compliance with EU and national law, including competition law. _________________ 5 REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) 6 REGULATION (EU) 2023/2854 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act)
#100 Recital 4 a (new)
Authored by
Text proposed by the Commission
Amendment
(4a) The Treaty on the Functioning of the European Union (TFEU) provides for the establishment of an internal market and the institution of a system ensuring that competition in the internal market is not distorted. The establishment of common rules and practices in the Member States relating to the development of a framework for data should contribute to the achievement of those objectives, while fully respecting fundamental rights. It should also guarantee the strengthening of the open strategic autonomy of the Union while fostering international free flow of data. The data economy has to be built in a way that enables undertakings, in particular micro, small and medium-sized enterprises (SMEs), as defined in the Annex to Commission Recommendation 2003/361/EC, and start-ups to thrive, ensuring data access neutrality and data portability and interoperability, and avoiding lock-in effects.
#101 Recital 5
Authored by
Text proposed by the Commission
(5) Acknowledging the iterative evolution of horizontal and sector-specific rules, it is indispensable to address also overlaps in specific provisions that result in unnecessary duplications of administrative burdens. This is the case in requirements across several rules for reporting following cybersecurity and related incidents, where digital solutions, as proposed in this Regulation, can bring an immediate relief to businesses across all concerned sectors.Amendment
(5) This Regulation found it is indispensable to address also overlaps in specific provisions that result in unnecessary duplications. This is the case in requirements across several rules for reporting following cybersecurity and related incidents, where digital solutions, as proposed in this Regulation, can bring an immediate relief to businesses across all concerned sectors.
#214 Recital 27
Authored by
Text proposed by the Commission
(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council15 . The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act. _________________ 15 Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (OJ L, 2025/327, 5.3.2025, ELI: http://data.europa.eu/eli/reg/2025/327/oj)Amendment
(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection.
noyb's comment:
The change pushes back at a very expansionist approach towards the use of 'pseudonymous' data.
#235 Recital 28
Authored by
Text proposed by the Commission
(28) In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as methodological and systematic approach applied while conducting the research in the specific area. Research and technology development should be conducted in academic, industry and other settings, including small and medium-sized undertakings, (Article 179(2) TFEU) and should be always of a of high quality and should adhere to the principles of principles of reliability, honesty, respect and accountability (verifiability).Amendment
(28) The qualification of processing as being carried out for scientific research purposes should be based on objective characteristics of the research activity and should not rely solely on the declaration of the controller, nor undermine the obligation to apply appropriate safeguards as provided for in Article 89 of Regulation (EU) 2016/679. In order to assess whether scientific research activities meet the conditions of scientific research for the purpose of Regulation (EU) 2016/679, account should be taken of elements such as the purpose of the research, the methodological approach and ethical standards applied in the specific area while conducting the research, and adherence to the principles of transparency, reliability, accountability, oversight, verifiability, and rules for research integrity. Scientific research activities should be conducted autonomously and independently, free from undue pressure and contribute to the growth of society’s public knowlewge, to public interest or serve the mankind. The results of scientific research should be published and they should be subjected to a double-blind peer review. It is important that scientific research activities prevent individuals from being subjected to harm or other adverse effects due to their participation in scientific research and respect, amongst others, human autonomy and the notion of consent to participate in research, which is to be considered distinctively from consent under Regulation (EU) 2016/679.
noyb's comment:
Important safeguards for data protection are added in case data would be usef for scientific research;
#249 Recital 29
Authored by
Text proposed by the Commission
(29) It should be reiterated that further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. In such cases it is not necessary to ascertain on the basis of Article 6(4) of this Regulation whether the purpose of the further processing is compatible with the purpose for which the personal data are initially collected.Amendment
(29) It should be reiterated that further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. In such cases it is not necessary to ascertain on the basis of Article 6(4) of this Regulation whether the purpose of the further processing is compatible with the purpose for which the personal data are initially collected. When processing is deemed to be undertaken for a compatible purpose by law, it does not preclude other legal requirements of this Regulation, such as the need to process data lawfully, fairly and in a transparent manner.
noyb's comment:
The additions do not include any new substantive element, but goes beyond common interpretation of the GDPR (see Recital 50 of the GDPR).
#254 Recital 30
Authored by
Text proposed by the Commission
(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
deleted
noyb's comment:
This amendment simply proposes to not alter recitals of the GDPR to include AI technologies.
#274 Recital 31
Authored by
Text proposed by the Commission
(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, providing an unconditional right to object to the processing of their personal data, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#283 Recital 32
Authored by
Text proposed by the Commission
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR seeks to ensure a proportionate balance between the right to protection of personal data, pursuant to Article 8 CFREU, and the freedom of science, pursuant to Article 13 CFREU.
noyb's comment:
Deletes new wording for the presumption of legitimate intersest in case of scientific research, leading to the current state of the law.
#298 Recital 33
Authored by
Text proposed by the Commission
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#313 Recital 34
Authored by
Text proposed by the Commission
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.Amendment
(34) Processing of biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric recognition includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of their claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming their identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should be allowed where the verification of the claimed identity of the data subject is necessary and proportionate for a legitimate purpose pursued by the controller, and subject to appropriate safeguards laid down under Union law. Where biometric data are processed for the purpose of confirming the identity of a data subject, controllers should, where possible, prioritise authentication methods that do not involve the processing of biometric data. When such verification is necessary, the controller should choose from equally effective means the least intrusive one. The processing of biometric data for identity verification should therefore only be used where necessary and proportionate and subject to appropriate safeguards. For the purposes of this Regulation, biometric identification should be understood as the processing of biometric data through comparison against a database intended to determine the identity of a natural person, whereas biometric verification refers to a one-to-one comparison used solely to confirm a claimed identity. This derogation should only apply where suitable safeguards apply to ensure that the biometric data or the means needed for the verification, such as sensors, cameras, or software that extract features and perform pattern recognition to verify the individual, are under the sole control of the data subject. Sole control means that the data subject can effectively decide when and how their biometric data are used for verification, without the controller having the technical capacity to access such biometric data in decrypted form or process them outside the strictly limited comparison process necessary for verification. For example, where the biometric data are securely stored solely at the device of the data subject or are securely stored by the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is securely held solely by the data subject, and subject to measures ensuring the overall security of processing, including during the enrolment phase of the data subject’s biometric data during the verification process. Such verification may in particular be required in the context of electronic identification systems and trust services under Union law. Other examples of appropriate safeguards are ensuring that end-to-end encryption is used when data are transmitted over a communication channel and providing data subjects with the possibility to securely rectify or delete their biometric data at any time.
noyb's comment:
The amendment improves the Commission's proposal by reducing its scope of application but remains a decrease of protection compared to the current Article 9.
#340 Recital 36
Authored by
Text proposed by the Commission
(36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller. These should be the situations where the context of the relationship between the controller and the data subject is very clear and circumscribed and the controller’s activity is not data-intensive, such as the relationship between a craftsman and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment. In such circumstances, that is to say when the processing is non data-intensive, non-complex and where the controller collects a low amount of personal data, it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679. The same should apply to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.Amendment
(36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of their personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information.
noyb's comment:
Basically, deletion of Commission's proposal regarding an additional exemption from the information requirement in Art 13.
#346 Recital 36
Authored by
Text proposed by the Commission
(36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller. These should be the situations where the context of the relationship between the controller and the data subject is very clear and circumscribed and the controller’s activity is not data-intensive, such as the relationship between a craftsman and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment. In such circumstances, that is to say when the processing is non data-intensive, non-complex and where the controller collects a low amount of personal data, it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679. The same should apply to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.Amendment
(36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and as far as the data subject already has the information. To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller. These should be the situations where the context of the relationship between the controller and the data subject is very clear and circumscribed and the controller’s activity is not data-intensive, such as the relationship between a craftsman and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment. In such circumstances, that is to say when the processing is non data-intensive, non-complex and where the controller collects a low amount of personal data, it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679. The same should apply to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.
noyb's comment:
Only a small amendment of a more editorial nature. However, the Commission's proposal this builds upon is particularly unworkable for the SMEs which are supposed to be the beneficiaries of the provision.
#352 Recital 37
Authored by
Text proposed by the Commission
(37) Where the processing takes place for the purpose of scientific research and the provision of information to the data subject proves to be impossible or would involve a disproportionate effort it should not be necessary to provide the information provided for under Article 13 of this Regulation. The controller should make reasonable efforts to acquire contact details if they are readily available and acquisition would not require a disproportionate effort. The provision of the information would involve a disproportionate effort in particular where the controller at the time of collection of the personal data did not know or anticipate that it would process personal data for scientific research purposes at a later stage, in which case it may not have easily available contact details of the data subjects. In such situations the controller should inform data subjects indirectly, such as by making the information publicly available. The provision of such information should ensure that as many data subjects concerned as possible are reached. Relevant means to make the information publicly available should be determined depending on the context of the research project and the data subjects involved.Amendment
deleted
noyb's comment:
Pushing back against the extension of the exemption from information obligations in the case of processing for scientific purposes, is positive for the level of data protection since it requires data subjects to be informed about the processing of their data.
#367 Recital 38
Authored by
Text proposed by the Commission
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.Amendment
(38) Article 22 of Regulation (EU) 2016/679 provides that data subjects have the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. However, when several equally effective processing solutions exist, the controller should use the less intrusive one. The data subject’s rights should not suffer due to the implementation of automated individual decision-making. Human involvement with regard to automated decision-making should be meaningful, and a mere symbolic gesture of viewing the decision made by a human without real and factual influence on the decision-making should not be categorised as human involvement. In order to ensure a consistent and high level of protection of natural persons, legal effects and similarly significant effects on the data subject should be interpreted broadly, and include decisions such as payment methods offered to a data subject and prices shown to a data subject when visiting an online retailer.
noyb's comment:
Highlighting the broad interpretation of a decision's effect pushes for a higher level of data protection.
#381 Recital 39
Authored by
Text proposed by the Commission
(39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches.Amendment
(39) In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should establish and make public a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person, a common list of circumstances in which a personal data breach does not result in such a high risk, as well as a common list of circumstances in which a personal data breach does not result in a risk to the rights and freedoms of a natural person. In order to take account of new information security threats, the common template and the lists should be reviewed at least every three years and updated where necessary. The Commission may adopt, by means of an implementing act, the common template as established by the Board, as well as its updates where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches. The common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should apply in order to determine when communicating the data breaches to the data subject, in accordance with Article 34.
noyb's comment:
This proposal gets rid of the Commission’s proposal to reduce the threshold for the obligation to notify the authority about a data breach. At the same time, it keeps an amended version of the establishment of lists and templates which should provide for more clarity.
#402 Recital 43 a (new)
Authored by
Text proposed by the Commission
Amendment
(43a) Article 7 of the Charter of Fundamental Rights of the European Union ("the Charter") protects the fundamental right of everyone to the respect for his or her private and family life, home and communications. Respect for the privacy of one’s communications is an essential dimension of this right. Confidentiality of electronic communications ensures that information exchanged between parties and the external elements of such communication, including when the information has been sent, from where, to whom, is not to be revealed to anyone other than to the parties involved in a communication. The principle of confidentiality should apply to current and future means of communication, including calls, internet access, instant messaging applications, e-mail, internet phone calls and personal messaging provided through social media. The confidentiality of electronic communications provided for by Article 7 of the Charter should be ensured and the information related to the terminal equipment of users accessing their publicly available websites and mobile applications should be protected.
#403 Recital 43 b (new)
Authored by
Text proposed by the Commission
Amendment
(43b) The content of electronic communications pertains to the essence of the fundamental right to respect for private and family life, home and communications protected under Article 7 of the Charter. Any processing of content data of electronic communications should be allowed only under strictly defined conditions, for specific purposes and be subject to adequate safeguards against abuse. This Regulation provides for the possibility of providers of electronic communications services to process electronic communications data in transit, with the informed consent of all the users concerned. For example, providers may offer services that entail the scanning of emails to remove certain pre-defined material. Given the sensitivity of the content of communications, Regulation (EU)2016/679 sets forth a presumption that the processing of such content data will result in high risks to the rights and freedoms of natural persons. When processing such type of data, the provider of the electronic communications service should always carry out a data protection impact assessment and, if necessary, consult the supervisory authority prior to the processing. After electronic communications content has been sent by the user and received by the intended user or users, it may be recorded or stored by the user, users or by a third party entrusted by them to record or store such data, which could be the electronic communications service provider. Any processing of such stored communications data where the data is stored on behalf of the user must comply with Regulation (EU)2016/679.
noyb's comment:
In particular, the performance of a DPIA and the strict applicability of the GDPR increases the level of data protection.
#404 Recital 43 c (new)
Authored by
Text proposed by the Commission
Amendment
(43c) Interference with the confidentiality of metadata or interference with the protection of information stored in and related to users’ terminal equipment should only be considered to be lawful where it is strictly proportionate and necessary to protect an interest which is essential for the life of the data subject or that of another natural person. Such interference based on the vital interest of another natural person should take place only in a specific case and where the processing cannot be manifestly based on another legal basis.
#405 Recital 43 d (new)
Authored by
Text proposed by the Commission
Amendment
(43d) The processing of electronic communications data can be useful for businesses, consumers and society as a whole. However, users attach great importance to the confidentiality of their communications, including their online activities, and they want to control the use of electronic communications data for purposes other than conveying the communication. Regulation (EU)2016/679 should require providers of electronic communications services to obtain users' consent to process electronic communications metadata, which includes data on the location of the device generated for the purposes of granting and maintaining access and connection to the service. Where a type of processing of electronic communications metadata, in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, a data protection impact assessment and, as the case may be, a consultation of the supervisory authority should take place prior to the processing, in accordance with Articles 35 and 36.
noyb's comment:
No significant different from this recital to current framework.
#406 Recital 43 e (new)
Authored by
Text proposed by the Commission
Amendment
(43e) Terminal equipment of users of electronic communications networks and any information relating to the usage of such terminal equipment, whether, in particular, it is stored in or emitted by such equipment, requested from or processed in order to enable it to connect to another device and or network equipment, are part of the private sphere of the users requiring protection under the Charter of Fundamental Rights of the European Union and the European Convention for the Protection of Human Rights and Fundamental Freedoms. Given that such equipment contains or processes very sensitive data that may reveal details of the behaviour, psychological features, emotional, political and social preferences, including the content of communications, pictures, the location of individuals by accessing the GPS capabilities of the device, contact lists, and other information already stored in the device, the information related to such equipment requires enhanced privacy protection. Information related to the user’s device may also be collected remotely for the purpose of identification and tracking, using techniques such as the so-called ‘device fingerprinting’, often without the knowledge of the user, and may seriously intrude upon the privacy of these users. Furthermore, the so-called spyware, web bugs, hidden identifiers, tracking cookies and other similar unwanted tracking tools can enter user's terminal equipment without their knowledge in order to gain access to information, to store hidden information and to trace the activities. Techniques that surreptitiously monitor the actions of users, for example by tracking their activities online or the location of their terminal equipment, or subvert the operation of the users’ terminal equipment pose a serious threat to the privacy of users. Therefore, any such interference with the user's terminal equipment should be allowed only with the user's consent and for specific and transparent purposes.
noyb's comment:
States risks for privacy from fingerprinting and other techniques.
#407 Recital 43 f (new)
Authored by
Text proposed by the Commission
Amendment
(43f) Electronic communications data may also reveal information concerning legal entities, such as business secrets or other sensitive information that has economic value. Therefore, the provisions of Chapter IVa of this Regulation should apply to both natural and legal persons. Legal persons should have the same rights as users that are natural persons regarding the supervisory authorities.
#408 Recital 43 g (new)
Authored by
Text proposed by the Commission
Amendment
(43g) Users may consent to the processing of their metadata to receive specific services such as protection services against fraudulent activities (by analysing usage data, location and customer account in real time). In the digital economy, services are often supplied against counter-performance other than money, for instance by exposing users to advertisements. Consent for processing data from internet or voice communication usage will not be valid if the data subject has no genuine and free choice, or is unable to refuse or withdraw consent without detriment. Consent should not be considered as freely given if it is obtained through repetitive requests. In order to prevent such abusive requests, users should be able to order service providers to remember their choice not to consent and to adhere to technical specifications signalling not to consent, withdrawal of consent, or a refusal to all processing that may otherwise be based on consent including for purposes related to cross-site tracking or downstream processing for personalised advertising.
noyb's comment:
Largely restatest the GDPR or refers to proposals from the Omnibus.
#409 Recital 43 h (new)
Authored by
Text proposed by the Commission
Amendment
(43h) Respecting an indication of data subjects’ choices under Article 91e(1)(ba) of Regulation (EU)2016/679 should include, where applicable, refraining from storing or accessing personal data on terminal equipment for the purposes covered by the indication, unless and until the data subject changes their choice.
#410 Recital 43 i (new)
Authored by
Text proposed by the Commission
Amendment
(43i) The principles of data protection by design and by default should be taken into consideration regarding software placed on the market to enable electronic communication or to allow for the retrieval of information on the internet. This should entail that the most privacy protective settings should be enabled by default in accordance with Article 25 of this regulation to prevent the processing, including the storing, transmission and transfer of information already stored on the terminal equipment of a user, except where otherwise provided in Article 91c. At the time of installing the software the user should be offered different options allowing them to consent or to change the default privacy settings of the terminal equipment. Furthermore, the user should be offered different options to choose from to enable them to make an informed decision on whether or not to allow different processing activities, including but not limited to the storing and transmission of data. The user should be provided with understandable and easily to navigate language and settings, that should be adaptable and permit the user to revise the settings of their terminal equipment at any time. The user's choice should be communicated to other parties that should implement and enforce the user's choices and any updates thereof. Controllers should not design consent interfaces that could lead to the systematic overriding, undermining, or circumvention of automated and machine-readable indications. In the absence of an explicit affirmative action, consent should not be inferred from the default configuration of a browser or operating system, nor from the user’s practice of use of such tools.
#411 Recital 43 j (new)
Authored by
Text proposed by the Commission
Amendment
(43j) Exceptions to the obligation to obtain consent to make use of the processing and storage capabilities of terminal equipment or to access information stored in, or processed by, terminal equipment should be limited to situations that involve no, or only very limited, intrusion of privacy, for instance the technical storage or access which is strictly necessary and proportionate for the legitimate purpose of enabling the use of a service requested by the user. This may include the storing of information, such as cookies and other identifiers necessary for enabling the use of a service requested by the user, for the duration of a single established session on a website to keep track of the user's input when filling in online forms over several pages.
#412 Recital 43 k (new)
Authored by
Text proposed by the Commission
Amendment
(43k) Maintaining or restoring the technical security of a service provided by the controller and requested by the data subject or the technical security of the terminal equipment used for the provision of such service should only be allowed without consent to the extent that the security updates are proportionate, discretely packaged and do not in any way change the functionality of the software on the terminal equipment, including the interaction with other software or settings chosen by the user, the user is informed in advance each time an update is being installed, and the user has the possibility to turn off the automatic installation of these updates.
noyb's comment:
More privacy intrusive compared to current framework, even if more limited than Commission proposal.
#413 Recital 43 l (new)
Authored by
Text proposed by the Commission
Amendment
(43l) The exceptions to the obligation to obtain consent may also cover situations where users use a service across devices for the purpose of service personalisation and content recommendation. Such techniques, if implemented with appropriate privacy safeguards, could also be a legitimate and useful tool, for example, in measuring web traffic to a website. Such measuring could also be carried out by another party which acts as a data processor for the provider of the service. Similarly, providers of terminal equipment and the software needed to operate such equipment regularly could need access to configuration and other device information and the processing and storage capabilities to maintain the equipment or its use, and correct problems related to the equipment's operation. Information society providers and electronic communications service providers that engage in configuration checking to provide the service in compliance with the user's settings, and the mere logging of the fact that the user's device is unable to receive content requested by the user, should not constitute illegitimate access.
#414 Recital 43 m (new)
Authored by
Text proposed by the Commission
Amendment
(43m) Providers of online services may have a legitimate interest in monetising their services, including through advertising. Therefore, providers of online services should be able to deliver basic forms of online advertising that carry minimal privacy and personal data protection risks. That ability may become particularly important where users are able to refuse consent at the browser or operating system level for the processing of their personal data, as well as the storing and accessing of information on their terminal equipment. In such cases, without specific exemptions, online service providers would be unable to seek consent for low-risk advertising practices, even where they would have justifiable legitimate interests in doing so. Such low-risk advertising practices should therefore be exempt from the obligation to obtain consent for use of the processing and storage capabilities of terminal equipment.
noyb's comment:
Allows the use of personal data for advertising without consent. Not simpler, less clear what is what.
#415 Recital 43 n (new)
Authored by
Text proposed by the Commission
Amendment
(43n) Low-risk advertising practices that should be exempt from consent include the delivery and targeting of strictly limited contextual advertising, which should be restricted to processing information about the device, such as operating system and browser type, abstracted to high-level categories. For example, specific browser versions should not be processed for this purpose. Such advertising may also make use of coarse geolocation data abstracted to the level of a region, or at the narrowest to the level of a city; temporal information such as date and time; and the content the user is immediately viewing, abstracted to broad categories and taxonomies, such as "sports", "travel", or "luxury goods". Search query data should not fall within strictly limited contextual advertising.
noyb's comment:
More invasive than the current legal framework. Difficult to know if something is "low-risk" or not.
#416 Recital 43 o (new)
Authored by
Text proposed by the Commission
Amendment
(43o) To incentivise the uptake, effectiveness and attractiveness of strictly limited contextual advertising, certain additional practices should also be exempt from the consent requirement, including frequency capping, defence against ad fraud, and measurement and attribution. Exemptions for these practices should be defined narrowly, and should be conducted by the online service itself, or by a trusted third party acting exclusively on its behalf. For frequency capping, for example, the online service being accessed by the user may process no more than a counter, without any unique identifier, for the sole purpose of limiting a user's exposure to a particular advertisement.
noyb's comment:
Exceptions for online advertisement that weaken the current legal framework.
#417 Recital 43 p (new)
Authored by
Text proposed by the Commission
Amendment
(43p) These exemptions may further permit on-device processing by a browser or operating system, where such processing employs privacy-enhancing technologies and immediately anonymises and aggregates data through an aggregation service, reducing the risk of individual identifiability to a minimal level. On-device processing of this kind may only be used to support strictly limited contextual advertising, and the underlying data may not be used for any other purpose including profiling, training artificial intelligence systems, or any other secondary use. Data that is not required for the permitted purpose should be deleted immediately.
noyb's comment:
Further exceptions to have software-side installed tracking.
#418 Recital 43 q (new)
Authored by
Text proposed by the Commission
Amendment
(43q) Creating instant anonymous aggregated information about the usage of an online service to measure the audience of such a service where it is carried out by the controller of that online service or by a processor acting on behalf of this controller for the sole use of the controller, means processing to obtain insight into the performance and use of the online service in an instantly anonymised, aggregated and general manner. The aggregated information should not relate to a specific data subject and should therefore be anonymous aggregated information. It should not involve fingerprinting techniques or the creation of persistent identifiers. The data collected should not be further processed for another purpose, combined with data from other services from the provider of the online service or from a third party, such as analytics information from other websites or apps, or shared with third parties.
noyb's comment:
More instrusive than the current framework, yet better than the Commission proposal.
#419 Recital 43 r (new)
Authored by
Text proposed by the Commission
Amendment
(43r) Strictly limited contextual advertising, frequency capping, and audience measurement should not be based on any type of profiling, nor involve any retention or link with the user's past or future activity, any combining with other personal data about the individual, nor linkability of identifiers to other personal data about the individual. Personal data and metadata regarding the data subject should be deleted immediately after any strictly necessary measurement of the advertisement’s display or performance has occurred and in any case after the browsing session is closed. Cookies used for contextual advertising should be exclusively temporary, transient, non-persistent cookies that are immediately deleted after the browsing session, or any equivalent technology technically designed to expire automatically.
#420 Recital 44
Authored by
Text proposed by the Commission
[...]Amendment
deletedJustification
Replaced with recitals 43a-43r tabled as amendments.
#469 Recital 46
Authored by
Text proposed by the Commission
(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser or in the EU Digital Identity Wallet as set out by Regulation (EU) 914/2014, or any other adequate means. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, media service providers should not be obliged to respect the machine-readable indications of data subject’s choices. The obligation for providers of web browsers to provide the technical means for data subjects to make choices with respect to the processing should not undermine the possibility for media service providers to request consent by data subjects.Amendment
(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, the obligation for providers of web browsers to provide the technical means for data subjects to make choices with respect to the processing should not undermine the possibility for media service providers to request consent by data subjects.
#472 Recital 46 a (new)
Authored by
Text proposed by the Commission
Amendment
(46a) When the processing of electronic communications data by providers of electronic communications services falls within its scope, this Regulation should provide for the possibility for the Union or Member States under specific conditions to restrict by law certain obligations and rights when such a restriction constitutes a necessary and proportionate measure in a democratic society to safeguard specific public interests, including national security, defence, public security and the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. Therefore, this Regulation should not affect the ability of Member States to carry out lawful interception of electronic communications or take other measures, if necessary and proportionate to safeguard the public interests mentioned above, in accordance with the Charter of Fundamental Rights of the European Union and the European Convention for the Protection of Human Rights and Fundamental Freedoms, as interpreted by the Court of Justice of the European Union and of the European Court of Human Rights.
noyb's comment:
This is already foreseen in the GDPR and does not bring about a significant change.
#475 Recital 46 b (new)
Authored by
Text proposed by the Commission
Amendment
(46b) In order to safeguard the security and integrity of networks and services, the use of end-to-end encryption should be promoted and, where necessary, be mandatory in accordance with the principles of security and privacy by design. Member States should not impose any obligation on encryption providers, on providers of electronic communications services or on any other organisations (at any level of the supply chain) that would result in the weakening of the security of their networks and services, such as the creation or facilitation of “backdoors”.
#478 Recital 47
Authored by
Text proposed by the Commission
(47) Directive 2002/58/EC on privacy and electronic communications ‘ePrivacy Directive’), last revised in 2009, provides a framework for the protection of the right to privacy, including the confidentiality of communications. It also specifies Regulation (EU) 2016/679 in relation to processing of personal data in the context of electronic communication services. It protects the privacy and the integrity of user’s or subscriber’s terminal equipment used for such communications. The current provision of Article 5(3) of Directive 2002/58/EC should remain applicable insofar as the subscriber or user is not a natural person, and the information stored or accessed does not constitute or lead to the processing of personal data.Amendment
deletedJustification
Access to terminal equipment and confidentiality of communications is moved to Regulation (EU) 2016/679 in amendments.
noyb's comment:
Deletes the Commission approach and goes back the current situation.
#922 Article 1 (Article 3 – paragraph -1 (new))
Authored by
Regulation (EU) 2016/679
Article 1
Present text
Subject-matter and objectives 1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data. 2. This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. 3. The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.Amendment
-1 Article 1 is replaced by the following: "Subject-matter and objectives 1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data as well as the protection of terminal equipment of users and the confidentiality of information stored thereon. 2. This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. It further protects the right to privacy in respect to storing information on or gaining access to information stored on terminal equipment of users. 3. The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data."Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
noyb's comment:
The change is a (technical) consequence of moving ePrivacy provisions into the GDPR.
#925 Article 2 (Article 3 – paragraph -1 a (new))
Authored by
Regulation (EU) 2016/679
Article 2
Present text
Material scope 1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. 2. This Regulation does not apply to the processing of personal data: (a)in the course of an activity which falls outside the scope of Union law; (b)by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c)by a natural person in the course of a purely personal or household activity; (d)by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. 3. For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98. 4. This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive.Amendment
-1 a Article 2 is replaced by the following: "Material scope 1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. 2. This Regulation does not apply to the processing of personal data: (a)in the course of an activity which falls outside the scope of Union law; (b)by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c)by a natural person in the course of a purely personal or household activity; (d)by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. 3. For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98. 3a. This Regulation applies to the storing of information, or gaining of access to information already stored, in terminal equipment of users. 4. This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive."Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
noyb's comment:
The amendment is a technical reflection of moving ePrivacy provisions into the GDPR
#927 Article 3 (Article 3 – paragraph 1 – point -1 b (new))
Authored by
Regulation (EU) 2016/679
Article 3
Present text
Territorial scope 1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a)the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b)the monitoring of their behaviour as far as their behaviour takes place within the Union. 3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.Amendment
-1 Article 3 is replaced by the following: "Territorial scope 1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a)the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b)the monitoring of their behaviour as far as their behaviour takes place within the Union. 3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law. 4. This Regulation applies to the storing of information, or gaining of access to information already stored, in terminal equipment of users."Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
noyb's comment:
The amendment sis a technical reflection of moving ePrivacy provisions into the GDPR
#932 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – second part
Text proposed by the Commission
(a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#952 Article 4 – point 33 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 33
Text proposed by the Commission
(33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply;Amendment
(33) the definitions of ‘electronic communications network’, ‘electronic communications service’, ‘interpersonal communications service’ in points (1), (4) and (5) respectively of Article 2 of Directive (EU) 2018/1972 shall apply. For the purposes of this Regulation, the definition of ‘interpersonal communications service’ shall include services whether provided for remuneration or not, as well as services which enable interpersonal and interactive communication merely as a minor ancillary feature that is intrinsically linked to another service;Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
#955 Article 4 – point 34a (new) (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 34a (new)
Text proposed by the Commission
Amendment
(34a) ‘operating system’ means a system software as defined in Article 2(10) of Regulation (EU) 2022/1925;
#965 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38
Text proposed by the Commission
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.Amendment
(38) “scientific research” means research conducted in an autonomous and independent manner, with the aim of contributing to the growth of society’s public knowledge, to the public interest or to serve the mankind, generating new or complementing existing scientific knowledge, following a methodological and systematic approach consistent with generally recognised ethical standards, including the respect for human autonomy and the concept of consent to participate in research, as well as standards applicable in the relevant scientific field, producing evidence-based, testable, transparent and published results.
#978 Article 4 – point 38a (new) (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38a (new)
Text proposed by the Commission
Amendment
(38a) ‘user’ means a natural or legal person using or requesting a publicly available electronic communications service as defined in Article 2(14) of Directive (EU) 2018/1972;Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
#984 Article 4 – point 38b (new) (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38b (new)
Text proposed by the Commission
Amendment
(38b) ‘electronic communications data’ means electronic communications content data and metadata;Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
#985 Article 4 – point 38c (new) (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38c (new)
Text proposed by the Commission
Amendment
(38c) ‘electronic communications metadata’ means data processed in an electronic communications network for the purposes of transmitting, distributing or exchanging electronic communications content, including data used to trace and identify the source and destination of a communication or another type of interaction, data on the location of the terminal equipment or user, data processed or generated in the context of providing services, including additional information about the service, and the date, time, duration and the type of communication, size, route, format and the protocol used and the type of compression.Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
#989 Article 4 – point 38d (new) (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38d (new)
Text proposed by the Commission
Amendment
(38d) ‘electronic communications content data’ means any data transmitted, distributed or exchanged by means of electronic communications services, in a digital format, such as text, voice, videos, images and sound. Where metadata of other electronic communications services or protocols are transmitted, distributed or exchanged by using the respective service, they shall be considered electronic communications content for the respective service.Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
#993 Article 5 – paragraph 1 – point b (Article 3 – paragraph 1 – point 2)
Authored by
Regulation (EU) 2016/679
Article 5 – paragraph 1 – point b
Text proposed by the Commission
collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);Amendment
collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the application of appropriate safeguards in accordance with Article 89(1) and the principle of lawfulness, be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);
noyb's comment:
The additions do not include any new substantive element and restate the derogation to Article 6(4) which is not foreseen under the current regime, as interpreted by EDPB Guidelines 1/2026.
#1022 Article 9 – paragraph 2 – point k (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k
Text proposed by the Commission
(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently, as interpreted by EDPB Opinion 28/2024.
#1048 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 5
Text proposed by the Commission
(b) the following paragraph is added: ‘5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as it currently is.
#1102 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 4
Text proposed by the Commission
5. In Article 13, paragraph 4 is replaced by the following: ‘4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.’Amendment
deleted
#1117 Article 13 – paragraph 5 (Article 3 – paragraph 1 – point 6)
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 5
Text proposed by the Commission
6. In Article 13, paragraph 5 is added: ‘5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.’Amendment
deleted
#1150 Article 22 – paragraph 1 – point a (Article 3 – paragraph 1 – point 7)
Authored by
Regulation (EU) 2016/679
Article 22 – paragraph 1 – point a
Text proposed by the Commission
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means;Amendment
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller;
#1167 Article 23 – paragraph 1 (Article 3 – paragraph 1 – point 7 a (new))
Authored by
Regulation (EU) 2016/679
Article 23 – paragraph 1
Present text
1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard: (a)national security; (b)defence; (c)public security; (d)the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security: (e)other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security; (f)the protection of judicial independence and judicial proceedings; (g)the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions; (h)a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g); (i)the protection of the data subject or the rights and freedoms of others; (j)the enforcement of civil law claims.Amendment
7a. Article 23(1) is replaced by the following: "1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34 and Chapter IXa, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard: (a)national security; (b)defence; (c)public security; (d)the prevention, investigation, detection or prosecution of criminal offences or of unauthorised use of the electronic communication system, or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security: (e)other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security; (f)the protection of judicial independence and judicial proceedings; (g)the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions; (h)a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g); (i)the protection of the data subject or the rights and freedoms of others; (j)the enforcement of civil law claims."Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
#1183 Article 33 – paragraph 1 (Article 3 – paragraph 1 – point 8 – point a)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 1
Text proposed by the Commission
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.Amendment
1. In the case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56 of this Regulation. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
noyb's comment:
The proposal basically eliminates the changes in the Commission’s proposal lowering the level of data protection. (The switch from the current version “unless the personal data breach is unlikely” to “is likely” has probably no effect in practice.) This means also an increased administrative burden for controllers and supervisory authorities compared to the Commission’s proposal. The amendments regarding the single-entry point are kept from the Commission’s proposal.
#1185 Article 33 – paragraph 1 (Article 3 – paragraph 1 – point 8 – point a)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 1
Text proposed by the Commission
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.Amendment
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
noyb's comment:
This proposal keeps the most parts of the Commission’s proposal but strikes the increase in the deadline.
#1196 Article 33 – paragraph 6 (Article 3 – paragraph 1 – point 8 – point c)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 6
Text proposed by the Commission
6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).Amendment
6. The Board shall establish and make public a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as a list of the circumstances in which a personal data breach is not likely to result in a risk to the rights and freedoms of a natural person under paragraph 1. The template and list shall be published within [OP date = nine months of the entry into application of this Regulation]. The Commission may adopt the template as established by the Board by way of an implementing act in accordance with the examination procedure set out in Article 93(2).
noyb's comment:
This amendment follows some considerations of the EDPB/EDPS opinion and shifts competences to the EDPB.
#1202 Article 34 (Article 3 – paragraph 1 – point 8 a (new))
Authored by
Regulation (EU) 2016/679
Article 34
Present text
Communication of a personal data breach to the data subject 1. When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay. 2. The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in points (b), (c) and (d) of Article 33(3). 3. The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions are met:(a)the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;(b)the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph 1 is no longer likely to materialise;(c)it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner. 4. If the controller has not already communicated the personal data breach to the data subject, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to in paragraph 3 are met.Amendment
8a. Article 34 is replaced by the following: "Communication of a personal data breach to the data subject 1. When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay. 2. The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in points (b), (c) and (d) of Article 33(3). 3. The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions are met:(a)the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;(b)the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph 1 is no longer likely to materialise;(c)it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner. 4. If the controller has not already communicated the personal data breach to the data subject, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to in paragraph 3 are met. 4a. The Board shall establish and make public a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person under paragraph 1."
noyb's comment:
This proposal (list of high risk scenarios) seems to be already covered by the already applicable Article 70(1)(h) GDPR and the commission proposal.
#1244 Article 41 a (new) (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41 a (new)
Text proposed by the Commission
10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#1304 Article 55 (Article 3 – paragraph 1 – point 10 a (new))
Authored by
Regulation (EU) 2016/679
Article 55
Present text
Competence 1. Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State. 2. Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply. 3. Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity.Amendment
10a. Article 55 is replaced by the following: "Article 55 Competence 1. Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State. 2. Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply. 3. Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity. 4. Each supervisory authority shall be competent to enforce the application of Chapter IXa in relation to processing of information of users who are on their territory. In such cases Article 56 does not apply."Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
#1321 Article 70 – paragraph 1 – point b (Article 3 – paragraph 1 – point 12 a (new))
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point b
Present text
(b) advise the Commission on any issue related to the protection of personal data in the Union, including on any proposed amendment of this Regulation;Amendment
12a. In Article 70 paragraph 1, point b is replaced by the following: "(b) advise the Commission on any issue related to the protection of personal data and the confidentiality of communications in the Union, including on any proposed amendment of this Regulation;"Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
noyb's comment:
Structural change due to other amendments. On its own, this amendment has no significant impact on privacy or simplification.
#1332 Article 70 – paragraph 1 – point hc (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc
Text proposed by the Commission
(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33Amendment
(hc) establish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33, a list of the circumstances in which it is not likely to result in a high risk, and a list of the circumstances in which it is not likely to result in any risk.
noyb's comment:
This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear lists simplify the application of the law.
#1339 Article 70 – paragraph 1 – point hca (new) (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hca (new)
Text proposed by the Commission
Amendment
(hca) In Article 70, the following point is inserted: '(hca) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for further specifying the criteria and conditions for lawful processing of electronic communications data pursuant to Article 91b and the protection of information transmitted to, stored in, related to, processed by and collected from users’ terminal equipment pursuant to Article 91c;'Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
noyb's comment:
This provision provides for further guidance by the EDPB and therefore for more claritiy.
#1344 Article 83 – paragraph 5 (Article 3 – paragraph 1 – point 14 a (new))
Authored by
Regulation (EU) 2016/679
Article 83 – paragraph 5
Present text
5. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: (a) the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9; (b) the data subjects' rights pursuant to Articles 12 to 22; (c) the transfers of personal data to a recipient in a third country or an international organisation pursuant to Articles 44 to 49; (d) any obligations pursuant to Member State law adopted under Chapter IX; (e) non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows by the supervisory authority pursuant to Article 58(2) or failure to provide access in violation of Article 58(1).Amendment
14a. Article 83 paragraph 5 is replaced by the following: "5. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: (a) the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9; (b) the data subjects' rights pursuant to Articles 12 to 22; (c) the transfers of personal data to a recipient in a third country or an international organisation pursuant to Articles 44 to 49; (d) any obligations pursuant to Member State law adopted under Chapter IX; (e) non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows by the supervisory authority pursuant to Article 58(2) or failure to provide access in violation of Article 58(1). (f) confidentiality of Communications pursuant to Articles 91a, 91b, 91c, 91d and 91e."Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
noyb's comment:
This amendment makes clear how violations against potentially added “confidence of communication” provisions should be handled; i.e. with the higher limit for fines.
#1350 Article 84 – paragraph 1 (Article 3 – paragraph 1 – point 14 b (new))
Authored by
Regulation (EU) 2016/679
Article 84 – paragraph 1
Present text
1. Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. Such penalties shall be effective, proportionate and dissuasive.Amendment
14b. Article 84(1) is replaced by the following: "1. Member States shall lay down the rules on other penalties, including criminal sanctions where appropriate, applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. Such penalties shall be effective, proportionate and dissuasive."
noyb's comment:
Pure clarification of the already existing regime (see Recital 149 of the GDPR).
#1358 Articles 88a, 88b, 88c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Articles 88a, 88b, 88c
Text proposed by the Commission
15. [...]Amendment
deletedJustification
Articles 88a and 88b amended and moved as new articles 91c and 91e under Chapter IXa.Article 88c is deleted.
#1594 Articles 91a, 91b, 91c, 91d, 91e (new) (Article 3 – paragraph 1 – point 15 a (new))
Authored by
Regulation (EU) 2016/679
Articles 91a, 91b, 91c, 91d, 91e (new)
Text proposed by the Commission
Amendment
15a. After Article 91 the following Chapter is added: 'Chapter IXa Confidentiality of communications and processing of electronic communications and information in terminal equipment Article 91a Confidentiality of electronic communications Electronic communications shall be confidential. Any interference with electronic communications, such as listening, tapping, storing, monitoring, scanning or other types of interception, surveillance, or any processing of electronic communications, by persons other than the user using the terminal equipment, shall be prohibited. Confidentiality of electronic communications shall also apply to data related to or processed by the terminal equipment. Article 91b Lawful processing of electronic communications data 1. Providers of electronic communications networks and electronic communications services may process electronic communications data only if it is technically necessary to achieve the transmission of the communication, for the duration necessary for that purpose. 2. Providers of electronic communications networks and services, or other parties acting on behalf of the provider or the user, may process electronic communications data only if it is technically necessary to maintain or restore the availability, integrity and confidentiality of the respective electronic communications network or services, or to detect technical faults and/or errors in the transmission of electronic communications, for the duration necessary for that purpose. 3. Providers of electronic communications networks and services may process electronic communications metadata only if: (a) processing is strictly necessary to meet mandatory quality of service requirements, including network management, pursuant to Directive (EU) 2018/1972 or Regulation (EU) 2015/2120 for the duration technically necessary for that purpose; (b) processing is strictly necessary for billing, determining interconnection payments, detecting or stopping fraudulent use of, or subscription to, electronic communications services; (c) the user concerned has given their consent to the processing of their communications metadata for one or more specified purposes in accordance with Article 4(11) provided that the purpose or purposes concerned could not be fulfilled without processing such metadata. 4. Providers of the electronic communications services may process electronic communications content data only: (a) for the sole purpose of the provision of a specific service requested by the user, if the -user concerned has given their consent to the processing of their electronic communications content data and the provision of that service cannot be fulfilled by the provider without the processing of such content data; (b) if all users have consented to the processing of their electronic communications content pursuant to Article 4(11) for one or more specified purposes that cannot be fulfilled by processing information that is made anonymous; or (c) for the purpose of the provision of a specific service explicitly requested by a user, for purely personal use, only for the duration necessary for that purpose and without the consent of all users only where such requested processing does not adversely affect the fundamental rights and interests of another user or users. Article 91c Protection of information transmitted to, stored in, related to, processed by and collected from users’ terminal equipment 1. Storing of information, or gaining of access to information already stored, in the terminal equipment including about its software and hardware, other than by the user concerned, shall be prohibited, except on the following grounds: (a) it is strictly necessary for the sole purpose of carrying out the transmission of an electronic communication over an electronic communications network, or; (b) the user has given their specific consent in accordance with this Regulation, or; (c) it is strictly technically necessary for providing an information society service specifically requested by the user; or (d) it is technically necessary for maintaining or restoring the technical security of a service provided by the controller and requested by the user, or; (e) for the purpose of delivering a form of online advertising (“strictly limited contextual advertising”), which is limited to processing the following information: i) information about the device, operating system and a browser; ii) coarse geolocation data, which is abstracted to the city level; iii) temporal information, such as date and time, and; iv) the content the user is immediately viewing, abstracted in broad categories. (f) for the purpose of limiting the number of times a specific advertisement is presented to the user (“first party frequency capping”), when such limitation meets the following conditions: i) an advertisement is delivered as defined under Article 91c (1) (e) of this Regulation; ii) information stored consists exclusively of a counter, or equivalent minimal signal; iii) information is stored by the provider of the online interface on which the advertisement is presented, and is automatically deleted no later than 14 days after creation, and; iv) the information is not used for any purpose other than frequency capping, is not combined, directly or indirectly, with any other dataset, including but not limited to identifiers, or data obtained from third parties, and the information is not transmitted to, or made accessible to any party other than the controller operating the domain under which it is stored. (g) for the purpose of measuring the reach and performance of specific advertising or an advertising campaign (“privacy preserving attribution”), when such measurement meets all of the following conditions: i) an advertisement is delivered as defined under Article 91c (1) (e) of this Regulation; ii) data is pseudonymised at the earliest stage possible; iii) data is processed solely on device and in an aggregated manner, and; iv) the information is not used for any purpose other than frequency capping, is not combined, directly or indirectly, with any other dataset, including but not limited to identifiers, or data obtained from third parties, and the information is not transmitted to, or made accessible to any party other than the controller operating the domain under which it is stored. (g) for the purpose of creating instant anonymous aggregated information about the usage of an online service requested by the user to measure the audience of such a service, where it is carried out by the provider of that online service requested by the user solely for its own use, or by a processor acting on behalf of this controller, solely for the controller’ own use and not further processed for any other purpose, not combined with data from other services from the provider of the online service, or from a third party, nor shared with any third party; (h) for the purpose of verifying the user’s past refusal to a request to consent without involving the use of a unique identifier or additional processing of personal data. 2. Where storing of information, or gaining of access to information already stored, in the terminal equipment of a user is based on consent, the following shall apply: (a) the user shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the user gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the user; (c) if the user declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of information based on consent. 3. No user shall be denied access to a renumerated service or functionality on grounds that they have not given their consent to the processing of their personal data and/or the use of the processing or storage capabilities of their terminal equipment that are not necessary for the provision of that service or functionality. 4. This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation] Article 91d Information and options for privacy settings to be provided Software placed on the market permitting electronic communications and/or the retrieval and presentation of information on the internet, shall (a) by default, have, in accordance with Article 25 of this Regulation, privacy protective settings activated to prevent other parties from transmitting to or storing information on the terminal equipment of a user and from processing information already stored on or collected from that equipment, except for the purposes laid down in Article 91c. (b) upon installation, inform and offer the user the possibility to change or confirm the privacy settings options defined in point (a) by requiring the user's consent to a setting and offer the option to prevent other parties from processing information transmitted to, already stored on or collected from the terminal equipment for the purposes laid down by Article 91c; (c) offer the user the possibility to express specific consent through the settings after the installation of the software. The technical settings shall consist of multiple options for the user to choose from, including an option to prevent the storage of information on the terminal equipment of a user and the processing of information already stored on, or processed by, that equipment. These settings shall be easily accessible during the use of the software and presented in a manner that gives the user the possibility for making an informed decision. The settings shall lead to a signal based on technical specifications which is sent to the other parties to inform them about the user's intentions with regard to consent, withdrawal of consent or objection. This signal shall be legally valid and be binding on, and enforceable against, any other party. For software already placed on the market at the entry into force of this Regulation, the requirements under points (a) to (c) shall be complied with at the time of the first update of the software, but no later than one year after entry into force of this Regulation. Article 91e Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons 1. Controllers shall ensure that their online interfaces allow data subjects to: (a) Give specific consent per purpose through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent, exercise the right to withdraw consent pursuant to Article 7(3) and the right to object pursuant to Article 21(1) and 21(2) through automated and machine-readable means. (c) refuse, by automated and machine-readable means, such as automated signals, all processing on terminal equipment that may otherwise be based on consent through automated and machine-readable means. This shall include processing for purposes related to cross-site tracking, profiling, personalised content, personalised advertising, and training of artificial intelligence systems. 2. Controllers shall respect the choices made by data subjects in accordance with paragraph 1. 3. Points (a) and (b) in paragraph 1 shall not apply to controllers that are media service providers when providing a media service. 4. Controllers shall not request the consent or choices of the data subject made in accordance with paragraph 1 (c) for the same purposes through separate consent or similar interfaces unless the data subject actively modifies their initial choices. The choices made by data subjects in accordance with paragraph 1 shall be communicated to all online interfaces visited by the data subject when using the same terminal equipment. 5. The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1. 6. The Commission shall ensure a balanced representation of interests and the effective participation of all relevant stakeholders in the standardisation process in accordance with Article 5 of Regulation (EU) No 1025/2012. 7. The Commission shall adopt implementing acts establishing common specifications for the requirements set out in paragraph 1 if the following conditions are fulfilled: (a) the Commission has requested one or more European standardisation organisations to draft harmonised standards as set out in paragraph 5, and: (i) the request has not been accepted by any of the European standardisation organisations; or (ii) the harmonised standards addressing that request are not delivered within the deadline set in accordance with Article 10(1) of Regulation (EU) No 1025/2012; or (iii) the harmonised standards do not comply with the request; and (b) no reference to harmonised standards covering the requirements set out in paragraph 1 of this article has been published in the Official Journal of the European Union in accordance with Regulation (EU) No 1025/2012 and no such reference is expected to be published within a reasonable period. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). 8. Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation]. 9. Providers of software to access online interfaces, such as operating systems or web browsers, shall provide the technical means to allow data subjects to exercise, modify or withdraw their choices as defined in paragraph 1 of this Article through the automated and machine-readable means referred to therein. 10. The data subject’s choices set out in paragraph 1 shall be managed by a third-party software provider acting structurally and economically independently from the software providing access to online interfaces. 11. Where the third-party software provider, as referred to in paragraph 10, is itself a controller processing personal data on the terminal equipment of the data subject, the refusal signal referred to in Paragraphs 1 and 4 shall apply to such processing on the same terms as it applies to any other controller. In such a case, those software providers shall not process data derived from the data subject’s interaction with that software for purposes other than those necessary for provisioning of this software, including for purposes such as advertising, profiling, audience building, attribution, or the training of AI systems. Paragraph 9 shall apply from [OP: please insert the date = 18 months following the date of entry into force of this Regulation].'
noyb's comment:
Amendment seems to rely on previous work on the ePrivacy Regulation. Overall relevant protection, but also some elements that go beyond the current rules (e.g. frequency capping or contextual ads). Overall awarded "neutral" because the AM has too many elements to meet our methodology.
#1719 Article 5 (Article 5 – paragraph 1 – point 2 – introductory part)
Authored by
Directive 2002/58/EC
Article 5
Text proposed by the Commission
2. After Article 5(3), the following subparagraph is added:Amendment
2. Article 5 is deleted:Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
noyb's comment:
Removes the ePrivacy protection. According to the justification to introduce protections in the GDPR.
#1724 Article 5 – paragraph 3 – subparagraph 2 (new) (Article 5 – paragraph 1 – point 2)
Authored by
Directive 2002/58/EC
Article 5 – paragraph 3 – subparagraph 2 (new)
Text proposed by the Commission
This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.Amendment
deletedJustification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
#1731 Article 6 (Article 5 – paragraph 1 – point 2 a (new))
Authored by
Directive 2002/58/EC
Article 6
Text proposed by the Commission
Amendment
2a. Article 6 is deleted.Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.