51 GDPR-relevant amendments by Diego Solier
#82 Recital 2
Authored by
Text proposed by the Commission
(2) Union digital legislation sets high standard in the Union and can be a powerful source of competitive advantage for businesses that abide by the rules, showing a world-leading mark of quality, safety and trustworthiness. Digital regulations have framed the clear rules of the game in the Union for responsible businesses, ensuring fairness and transparency in business-to-business relations, stimulating innovative business models, setting high standard of consumer protection and safety, and for the protection fundamental rights, not least privacy and data protection.Amendment
(2) Union digital legislation sets high standard in the Union and was supposed to be a powerful source of competitive advantage for businesses that abide by the rules, showing a world-leading mark of quality, safety and trustworthiness. While digital regulations have framed the clear rules in the Union for responsible businesses, with the objective of ensuring fairness and transparency in business-to-business relations, stimulating innovative business models, setting high standard of consumer protection and safety, and for the protection fundamental rights, not least privacy and data protection, digital regulation has instead created a regulatory environment that favours those companies who have significant resources and can afford to incorporate significant compliance costs into their operations. This creates a significant disadvantage for start-ups, scale ups and SMEs.
noyb's comment:
Narrative without direct factual basis. Amounts to a political statement in a non-binding recital. No direct impact on simplification or privacy.
#94 Recital 3
Authored by
Text proposed by the Commission
(3) Union digital legislation has evolved incrementally over the past years, in response to the rapidly growing footprint of digital technologies in the Union’s economy and societal dynamic, and in view of addressing emerging challenges and promoting business opportunities in the EU. Notwithstanding the Commission’s commitment to a systematic ‘stress test’ of the digital rules, along with other Union rules, which might lead to further regulatory adjustments notably following the forthcoming Digital Fitness Check, as well as other targeted evaluations of digital rules, immediate regulatory changes are necessary. Consequently, this Regulation proposes a first set of amendments to the digital legislative framework, aimed at providing immediate regulatory clarifications that stimulate innovation in the Union market, and that cut administrative compliance costs in particular for businesses, while also streamlining supervisory and administrative costs for supervisory authorities and advisory bodies. The amendments also seek to provide clarity to individuals.Amendment
(3) The number of union digital legislation has significantly increased over the past years, partly in response to the rapidly growing footprint of digital technologies in the Union’s economy and societal dynamic, and in view of addressing emerging challenges and promoting business opportunities in the EU. Notwithstanding the Commission’s commitment to a systematic ‘stress test’ of the digital rules, along with other Union rules, which might lead to further regulatory adjustments notably following the forthcoming Digital Fitness Check, as well as other targeted evaluations of digital rules, immediate regulatory changes are necessary. Consequently, this Regulation proposes a first set of amendments to the digital legislative framework, aimed at providing immediate regulatory clarifications that stimulate innovation in the Union market, and that cut administrative compliance costs in particular for businesses, while also streamlining supervisory and administrative costs for supervisory authorities and advisory bodies. The amendments also seek to provide clarity to individuals.
#221 Recital 27
Authored by
Text proposed by the Commission
(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council15 . The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act. _________________ 15 Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (OJ L, 2025/327, 5.3.2025, ELI: http://data.europa.eu/eli/reg/2025/327/oj)Amendment
(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council15 . The assessment of whether a controller possesses the means reasonably likely to be used to identify the natural person directly or indirectly should take into account technical and organisational measures, as well as state of the art technology. The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act. _________________ 15 Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (OJ L, 2025/327, 5.3.2025, ELI: http://data.europa.eu/eli/reg/2025/327/oj)
noyb's comment:
This recital does not include any new substantive element compared to the Commission's proposal. Overall, the original recital is a detriment to the fundamental rights of data subjects and the Amendment seems to support this approach in principle.
#238 Recital 28
Authored by
Text proposed by the Commission
(28) In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as methodological and systematic approach applied while conducting the research in the specific area. Research and technology development should be conducted in academic, industry and other settings, including small and medium-sized undertakings, (Article 179(2) TFEU) and should be always of a of high quality and should adhere to the principles of principles of reliability, honesty, respect and accountability (verifiability).Amendment
(28) In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as methodological and systematic approach applied while conducting the research in the specific area. Research and technology development should be conducted in academic, industry and other settings, including small and medium-sized undertakings, (Article 179(2) TFEU) and should be always of a of high quality and should adhere to the principles of reliability, honesty, respect and accountability (verifiability). Pursuing an additional commercial interest should not preclude research from meeting the conditions of scientific research for the purposes of this Regulation.
noyb's comment:
Clarification but widening scope of privileged data processing.
#258 Recital 30
Authored by
Text proposed by the Commission
(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. Europe faces a significant gap in AI development and deployment compared to global leaders, particularly the United States and China, which risks undermining the Union’s long-term competitiveness and innovative capacity. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. High-quality European data is therefore essential to close this gap, strengthen the Union’s innovative capacity, enable the training of competitive AI models by European businesses and researchers, and reduce dependence on non-European data and technology providers. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.
noyb's comment:
This amendment proposes including the "AI race" in the GDPR.
#277 Recital 31
Authored by
Text proposed by the Commission
(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, providing an unconditional right to object to the processing of their personal data, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.Amendment
(31) When the controller, in the light of the risk-based approach which takes into account the scalability of the obligations under this Regulation, assesses the balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, it shall take into account, in particular, the nature and purpose of the processing, including whether such processing is necessary for the development or improvement of AI systems or models of significant benefit for the Union’s economy, competitiveness or innovation. Further consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary to ensure accurate and factual outputs, and among other things, improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, providing an unconditional right to object to the processing of their personal data, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.
noyb's comment:
The proposed amendment highlights the necessity of processing activities for the Union's competitiveness and innovation, without taking into account fundamental rights.
#287 Recital 32
Authored by
Text proposed by the Commission
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research, which may also pursue an additional commercial interest, are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.
#293 Recital 32 a (new)
Authored by
Text proposed by the Commission
Amendment
(32a) Processing of personal data strictly necessary for professional communications between legal persons and their representatives shall be assessed taking into account the legitimate expectations of the parties and the specific characteristics of business-to-business relationships.
#295 Recital 32 b (new)
Authored by
Text proposed by the Commission
Amendment
(32b) The processing of operational data generated by connected industrial equipment, including machine-to-machine communications, remote maintenance, technical diagnostics and cybersecurity operations, shall be distinguished from consumer-facing digital services. Where personal data are involved, the application of this Regulation should take due account of the specific industrial context and the demonstrably lower risk to the rights and freedoms of natural persons, without prejudice to the safeguards provided for in this Regulation.
noyb's comment:
The impact is not clear, but hints at a lower protection if personal data is collected in the background via machines or IoT.
#304 Recital 33
Authored by
Text proposed by the Commission
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.Amendment
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the technical, organisational and state of the art capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in a manner it considers to be effective to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, taking into account the technical feasibility, the available resources, the nature of the AI system or model, and state of the art capabilities, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering or significant retraining of the AI system or AI model, the controller should take appropriate measures proportionate to the risks posed that effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.
noyb's comment:
This amendment contains several abstract parameters for the controllers to take into account and thus does not promote privacy, nor simplification.
#322 Recital 34
Authored by
Text proposed by the Commission
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.Amendment
(34) Processing of biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of recognition through biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a legitimate purpose pursued by the controller, and effective safeguards apply to enable the data subject to have sole control of the verification process. In order to protect the highly sensitive nature of biometric data, processing thereof should only occur outside the device of the data subject in highly exceptional cases and only when any such processing involves state of the art privacy technology, such as encryption, the key to which is in sole possession of the data subject, and zero knowledge proofs. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.
noyb's comment:
The amendment supports the Commission's proposal but proposes a technical change.
#332 Recital 35
Authored by
Text proposed by the Commission
(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. By contrast, it should be clarified in Article 12 of the Regulation that the right of access, which is from the outset favourable to data subjects, should not be abused in the sense that the data subjects abuse them for purposes other than the protection of their data. For example, such an abuse of the right of access would arise where the data subject intends to cause the controller to refuse an access request, in order to subsequently demand the payment of compensation, potentially under the threat of bringing a claim for damages. Other examples of abuse include situations where data subjects make excessive use of the right of access with the only intent of causing damage or harm to the controller or when an individual makes a request, but at the same time offers to withdraw it in return for some form of benefit from the controller. Moreover, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive conduct of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abuse only to a reasonable level. In any event, while requesting access under Article 15 of Regulation (EU) 2016/679 the data subject should be as specific as possible. Overly broad and undifferentiated requests should also be regarded as excessive.Amendment
(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. By contrast, it should be clarified in Article 12 of the Regulation that the right of access, which is from the outset favourable to data subjects, should not be abused in the sense that the data subjects abuse them for purposes other than the protection of their data. For the purpose of mitigating the harms of abusive requests on controllers, requests should be considered excessive where the controller can demonstrate abusive intention, taking into account the relevant circumstances. For example, such an abusive intention of the right of access would arise where the data subject intends to cause the controller to refuse an access request, in order to subsequently demand the payment of compensation, potentially under the threat of bringing a claim for damages. Other examples of abusive intention include situations where data subjects make excessive use of the right of access with the only intent of causing damage or harm to the controller or when an individual makes a request, but at the same time offers to withdraw it in return for some form of benefit from the controller. Moreover, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive intent of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abusive intent only to a reasonable level. In any event, while requesting access under Article 15 of Regulation (EU) 2016/679 the data subject should be as specific as possible. Overly broad and undifferentiated requests should also be regarded as excessive.
noyb's comment:
The amendment goes further than the restrictions proposed by the Commission.
#344 Recital 36
Authored by
Text proposed by the Commission
(36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller. These should be the situations where the context of the relationship between the controller and the data subject is very clear and circumscribed and the controller’s activity is not data-intensive, such as the relationship between a craftsman and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment. In such circumstances, that is to say when the processing is non data-intensive, non-complex and where the controller collects a low amount of personal data, it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679. The same should apply to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.Amendment
(36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of data controllers, in particular SMEs and micro-enterprises without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information or the data controller has taken reasonable steps available to it, taking into account relevant technical and organisational means to provide the data subject with the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller. These should be the situations where the context of the relationship between the controller and the data subject is very clear and circumscribed and the controller’s activity is not data-intensive, such as the relationship between SMEs, micro-enterprises and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment. In such circumstances, that is to say when the processing is non data-intensive, it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for legitimate interests, the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679. The same should apply to freelancers or sole traders providing services to their customers, local craftsmen, retailers or hospitality businesses, and associations and sport clubs, as well as other entities with similarly limited and transparent processing activities, such as small cultural or educational associations and non-profit organisations serving a clearly defined group of members or beneficiaries where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.
noyb's comment:
This proposal further elaborates on the Commission's proposal regarding an additional exemption from the information obligation in Article 13 GDPR. However, the provision is in particular unworkable for the SMEs which are supposed to be the beneficiaries of the provision.
#358 Recital 37
Authored by
Text proposed by the Commission
(37) Where the processing takes place for the purpose of scientific research and the provision of information to the data subject proves to be impossible or would involve a disproportionate effort it should not be necessary to provide the information provided for under Article 13 of this Regulation. The controller should make reasonable efforts to acquire contact details if they are readily available and acquisition would not require a disproportionate effort. The provision of the information would involve a disproportionate effort in particular where the controller at the time of collection of the personal data did not know or anticipate that it would process personal data for scientific research purposes at a later stage, in which case it may not have easily available contact details of the data subjects. In such situations the controller should inform data subjects indirectly, such as by making the information publicly available. The provision of such information should ensure that as many data subjects concerned as possible are reached. Relevant means to make the information publicly available should be determined depending on the context of the research project and the data subjects involved.Amendment
(37) Where the processing takes place for the purpose of scientific research and the provision of information to the data subject proves to be impossible or would involve a disproportionate effort, taking into account the relevant technical and organisational circumstances, it should not be necessary to provide the information provided for under Article 13 of this Regulation. The controller should make reasonable efforts to acquire contact details if they are readily available and acquisition would not require a disproportionate effort. The provision of the information would involve a disproportionate effort in particular where the controller at the time of collection of the personal data did not know or would not reasonably be expected to know or anticipate that it would process personal data for scientific research purposes at a later stage, in which case it may not have easily available contact details of the data subjects. In such situations the controller should inform data subjects indirectly, such as by making the information publicly available. The provision of such information should ensure that as many data subjects concerned as can reasonably be expected to are reached. Relevant means to make the information publicly available should be determined depending on the context of the research project and the data subjects involved.
noyb's comment:
The proposal is slightly more detrimental to the level of data protection than the initial proposal by the Commission. At the same time the level of complexity is further reduced for the controller invoking this exemption.
#370 Recital 38
Authored by
Text proposed by the Commission
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.Amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions considering the data intensiveness and risk associated with the processing are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one, when it does not result in a significant additional administrative burden for the controller.
noyb's comment:
This proposal not only introduce very uncertain factors to consider (what does it mean to consider the risk when assessing whether a data subject consented to the processing or whether a processing is necessary for concluding a contract?). The fact that a controller has to use the least intrusive means is an expression of the proportionality principle in Article 52 CFR. Waiving this principle in favour of avoiding additional administrative burden potentially violates this principle.
#386 Recital 39
Authored by
Text proposed by the Commission
(39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of communication of a personal data breach to the data subject under Article 34 of that Regulation. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches.Amendment
(39) In order to reduce the burden on controllers while ensuring that supervisory authorities have access to the relevant information and can act on violations of the Regulation, the threshold for notification of a personal data breach to the supervisory authority under Article 33 of Regulation (EU) 2016/679 should be aligned with that of other Union legislation governing cybersecurity incidents. In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should prepare a common template for notifying cybersecurity incidents to the competent authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The Commission should take due account of the proposal prepared by the Board and review them, as necessary, prior to adoption after consulting the European Parliament and Member States. In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where technological developments so require. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches.
noyb's comment:
This proposal changes the notion that the risk threshold for the data breach notification to the authority should be aligned with the threshold for the obligation to communicate the data breach to the data subject. Instead, the threshold should be aligned with "other Union legislation governing cybersecurity incidents". Which is unspecific and does not take into effect that different notification obligations could have different purposes and different thresholds could be required. This proposal therefore adds some uncertainty which reduces the simplification while the alignment of different notification regimes could provide for a smaller administrative burden. We assume that this somewhat cancels each other out.
#390 Recital 40
Authored by
Text proposed by the Commission
(40) Article 35 of that Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. In order to effectively contribute to the aim of convergence of the economies and to effectively ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to replace the existing national lists. In addition, the publication of a list of the type of processing operations for which no data protection impact assessment is required, which is currently optional, should be made mandatory. The lists of processing operations should be prepared by the Board and adopted by the Commission as an implementing act. In order to facilitate compliance by controllers, the Board should also prepare a common template and a common methodology for conducting data protection impact assessments, to be adopted by the Commission as an implementing act. The Commission should take due account of the proposals prepared by the Board and review them, as necessary, prior to adoption. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary.Amendment
(40) Article 35 of that Regulation (EU) 2016/679 requires controllers to conduct a data protection impact assessment where the processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. The supervisory authorities established pursuant to that Regulation are required to establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. In addition, the Regulation provides that supervisory authorities may establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. This has resulted in significant fragmentation across Member States, making it increasingly difficult for European businesses, particularly SMEs and micro-enterprises to expand and grow. In order to effectively contribute to the aim of convergence of the economies and to effectively encourage innovation, promote competitiveness, ensure free flow of personal data between Member States, increase legal certainty, facilitate compliance by controllers and ensure a harmonised interpretation of the notion of a high risk to the rights and freedoms of data subjects, a single list of processing operations should be provided at EU level, to serve as guidance. The lists of processing operations should be prepared by the Board and adopted by the Commission after consulting the European Parliament and Member States. In order to facilitate compliance by controllers, the Board should also prepare a common template and a common methodology for conducting data protection impact assessments, to serve as guidance for national authorities. In order to take account of technological developments, the lists and the common template and methodology should be reviewed at least every three years and updated where necessary.
noyb's comment:
This amendment reduces the legal certainty provided by the lists and templates provided for in the Commission’s proposal.
#424 Recital 44 – paragraph 1
Authored by
Text proposed by the Commission
The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment and the subsequent processing of such data should be regulated under a single legal framework, namely Regulation (EU) 2016/679, where the subscriber of the electronic communications service or the user of the terminal equipment is a natural person. The amendments presented in this Regulation continue to offer the highest levels of protection for personal data, while simplifying the experiences of data subjects in exerting their rights and expressing their choices online. The amendments concern in particular storage of information in that equipment, accessing or otherwise collecting information from that equipment that entails the processing of personal data through cookies or similar technologies to gain information from the terminal equipment. The relevant rules should also apply regardless of whether the terminal equipment is owned by the natural person or by another legal or natural person.Amendment
The storing of information, or the gaining of access to information already stored, in a terminal equipment and the subsequent processing of such data should be regulated under a single legal framework, namely Directive 2002/58/EC. The amendments presented in this Regulation should continue to offer the highest levels of protection for personal data, while simplifying the experiences of data subjects in exerting their rights and expressing their choices online. The amendments concern in particular storage of information in that equipment, accessing or otherwise collecting information from that equipment that entails the processing of personal data through cookies or similar technologies to gain information from the terminal equipment.
#429 Recital 44 – paragraph 2
Authored by
Text proposed by the Commission
The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment should continue to be allowed only on the basis of consent. Similar to the approach in Directive 2002/58/EC, this requirement should not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, when that is based on Union or Member State law within the meaning of Article 6 of Regulation (EU) 2016/679 and if it fulfils all conditions of lawfulness laid down in that provision, and is done for the objectives laid down in Article 23(1) of Regulation (EU) 2016/679.Amendment
The storing of information on, or the gaining of access to information already stored, in the terminal equipment of a natural person, in particular through cookies and similar technologies, should continue to be governed by Directive 2002/58/EC. In order to ensure legal certainty, avoid fragmentation and reduce unnecessary compliance burdens on businesses, a single and coherent regulatory framework should apply to all such practices, irrespective of whether they involve personal or non-personal data. A differentiated regime under which only cookies involving personal data would be subject to Regulation (EU) 2016/679 while others remain under Directive 2002/58/EC would create legal complexity and increase costs for undertakings, in particular small and medium-sized enterprises, without providing additional protection to data subjects. Therefore, the rules on the storing of information and gaining of access to information stored in terminal equipment should remain unified within the framework of Directive 2002/58/EC.
#438 Recital 44 – paragraph 3
Authored by
Text proposed by the Commission
With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. The controller, such as a media service provider, may mandate a processor, such as a market research company, to carry out the processing on its behalf.Amendment
With a view to increase innovation and competitiveness, reducing the compliance burden and providing legal clarity to all stakeholders, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide, among other things, a safe and functional service requested by the subscriber or user, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. As regards storing of information, or the gaining of access to information already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. The controller, such as a media service provider, may mandate a processor, such as a market research company, to carry out the processing on its behalf. Such exceptions should cover the transmission of electronic communications, the provision of a service explicitly requested by the user including its functionality and personalisation, audience measurement limited to aggregated data without repurposing for profiling or advertising, and joint audience measurement involving media service providers or their mandated entities. Exceptions should further include measures strictly necessary to ensure the security of the service or network and to prevent fraud directly related to the requested service, as well as the provision, display and measurement of contextual advertising based solely on the content immediately presented to the user, without any profiling. In recognition of the important role played by media service providers and the low privacy risk associated with their typical processing activities, specific provisions should also allow them to offer users a clear choice between consenting to the processing of personal data for purposes such as advertising, service improvement, product development and analytics, or paying a reasonable fee for an equivalent version of the service without such processing. In all cases, these exceptions are designed to strike an appropriate balance between the protection of users’ rights, the sustainability of media pluralism, and the need to foster innovation and competitiveness in the digital single market.
noyb's comment:
Relies on further exceptions to the current legal framework.
#450 Recital 44 – paragraph 4
Authored by
Text proposed by the Commission
For the subsequent processing of personal data for other purpose than those defined in the limitative list, Article 6 and, where relevant, Article 9 of Regulation (EU) 2016/679 should be applied. It is the responsibility of the controller in the light of the principle of accountability to choose the appropriate legal basis for the intended processing. In order to be able to rely on legitimate interest under Article 6(1), point f, of Regulation (EU) 2016/679 as a ground for the subsequent processing of personal data, the controller must show that it pursues the controller’s or third parties’ legitimate interest, the processing is necessary in order to achieve the purpose of that legitimate interest, and the interests or fundamental rights of the data subject do not override the interests pursued by the controller. In this context, controllers should take outmost account of the following elements: whether the data subject is a child; the reasonable expectations of data subject; the impact on the individual either because of the scale of data processed or the sensitivity of the data processed; the scale of the processing at issue in the sense that the processing cannot be particularly extensive either because of their amount or the range of categories of data; the processing should be based on data limited to what is necessary and cannot be based on monitoring of large parts of the online activity of the data subjects; and other relevant factors as appropriate. The processing should not give rise to the continuous monitoring of the data subject’s private life.Amendment
For the subsequent processing of personal data for other purpose than those defined in the limitative list, Article 6 and, where relevant, Article 9 of Regulation (EU) 2016/679 should be applied. It is the responsibility of the controller in the light of the principle of accountability to choose the appropriate legal basis for the intended processing. In order to be able to rely on legitimate interest under Article 6(1), point f, of Regulation (EU) 2016/679 as a ground for the subsequent processing of personal data, the controller must show that it pursues the controller’s or third parties’ legitimate interest, the processing is necessary in order to achieve the purpose of that legitimate interest, and the interests or fundamental rights of the data subject do not override the interests pursued by the controller. In this context, controllers should take outmost account of the following elements; whether the data subject is a child; the reasonable expectations of data subject; the impact on the individual either because of the scale of data processed or the sensitivity of the data processed; the scale of the processing at issue in the sense that the processing cannot be particularly extensive either because of their amount or the range of categories of data; the processing should be based on data limited to what is necessary and cannot be based on monitoring of large parts of the online activity of the data subjects; and other relevant factors as appropriate. The processing should not give rise to the monitoring of the data subject’s private life. Sensitive categories of personal data shoud only be processed in accordance with Article 9 of Regulation 2016/679, unless otherwise provided for in this regulation.
noyb's comment:
Adds information on Art. 9 GDPR, but otherwise relies on the permissive Commission proposal.
#453 Recital 44 – paragraph 5
Authored by
Text proposed by the Commission
Where the controller cannot rely on legitimate interest as a legal ground for the subsequent processing, the processing should be based on another ground in Article 6(1), in particular on consent in accordance with Articles 6 and 7 of Regulation (EU) 2016/679, provided that all principles of Regulation (EU) 2016/679 are met.Amendment
deleted
#461 Recital 45
Authored by
Text proposed by the Commission
(45) Data subjects that have refused a request for consent are often confronted with a new request to give consent each time they visit the same controller’s online service again. This may have detrimental effects to the data subjects which may consent just in order to avoid repeating requests. The controller should therefore be obliged to respect the data subject’s choices to refuse a request for consent for at least a certain period.Amendment
(45) Data subjects that have refused a request for consent are often confronted with a new request to give consent each time they visit the same controller’s online service again. This may have detrimental effects to the data subjects which may consent just in order to avoid repeating requests. The controller should therefore be obliged to respect the data subject’s refusal of consent for a reasonable period of time, taking into account the context of the processing, the means by which the data subject accessed the service, and technical feasibility. This obligation should not prevent a provider from requesting consent at a later stage, for example if the data subject requests to access the service, through a different device, browser, account or access method, nor should it lead to a disproportionate deterioration of the service or prevent the data subject from accessing the service under different conditions. The provider should also make available effective and easily accessible means for the data subject to withdraw or modify their choice at any time.
noyb's comment:
It is slightly less specific than the Commission proposal and foresees "proportionate deterioration of the service", but largely maintains the approach.
#470 Recital 46
Authored by
Text proposed by the Commission
(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser or in the EU Digital Identity Wallet as set out by Regulation (EU) 914/2014, or any other adequate means. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, media service providers should not be obliged to respect the machine-readable indications of data subject’s choices. The obligation for providers of web browsers to provide the technical means for data subjects to make choices with respect to the processing should not undermine the possibility for media service providers to request consent by data subjects.Amendment
(46) In order to address the issue of consent fatigue and to explore long-term technical solutions that enhance user autonomy while reducing the prevalence of interruptive cookie banners, the Commission is invited to promote a voluntary and time-limited pilot project. This pilot should aim to develop and test interoperable, machine-readable standards for communicating user preferences. Such a project should be developed in close cooperation with the European Data Protection Board (EDPB) and relevant stakeholders, ensuring it remains fully voluntary, technology-neutral, and without prejudice to the high level of protection provided by Directive 2002/58/EC and Regulation (EU)2016/679. The pilot should specifically evaluate the feasibility of decentralized standards that prevent market fragmentation and avoid the creation of new digital gatekeepers, while simultaneously protecting innovation and competitiveness in Europe and ensuring that European companies in the digital environment can continue to operate without significant and disproportionate disruptions to their business models.
noyb's comment:
Wants to make automated signals a voluntary project. Would not simplify the transactions in the near-term future.
#487 Recital 48
Authored by
Text proposed by the Commission
(48) Article 4 of Directive 2002/58/EC should be repealed. Article 4 of Directive 2002/58/EC sets requirements for providers of publicly available electronic communications services as regards safeguarding the security of their services and notification requirements. Subsequently, Directive (EU) 2022/2555 has set new requirements as regards cybersecurity risk-management measures and incident reporting for those providers. In order to reduce overlapping obligations for entities in the electronic communications sector, Article 4 of Directive 2002/58/EC should be repealed. As regards the security of processing of personal data pursuant to Article 4(1) and (1a) of this directive and the notification of personal data breaches pursuant to Article 4(3) to (5) of Directive 2002/58/EC this directive, the Regulation (EU) 2016/679 already provide for comprehensive and up-to-date rules. These rules should therefore apply to providers of publicly available electronic communication services and providers of public communications networks, thereby ensuring that one regime applies to the controllers and processors.Amendment
(48) Article 4 of Directive 2002/58/EC should be repealed. Article 4 of Directive 2002/58/EC sets requirements for providers of publicly available electronic communications services as regards safeguarding the security of their services and notification requirements. Subsequently, Directive (EU) 2022/2555 has set new requirements as regards cybersecurity risk-management measures and incident reporting for those providers. In order to reduce overlapping obligations for entities in the electronic communications sector, Article 4 of Directive 2002/58/EC should be repealed. As regards the security of processing of personal data pursuant to Article 4(1) and (1a) of this directive and the notification of personal data breaches pursuant to Article 4(3) to (5) of Directive 2002/58/EC this directive, the Regulation (EU) 2016/679 already provide for comprehensive and up-to-date rules. These rules should therefore apply to providers of publicly available electronic communication services and providers of public communications networks, thereby ensuring that one regime applies to the controllers and processors. The fragmented legal requirements in cybersecurity shall be consolidated into harmonized, single-entry-point reporting systems.
noyb's comment:
Simplification of reporting duties, although uncertain if the proposed new regime is equivalent to the current one.
#944 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – second part
Text proposed by the Commission
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.Amendment
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used through technical and organisational measures, as well as state of the art technology available to that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.
noyb's comment:
The amendment does not materially change the Commission's proposal, thus overall remains a decrease of protection compared to the current Article 4(1).
#949 Article 4 – point 32 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 32
Text proposed by the Commission
(32) ‘terminal equipment’ means terminal equipment as set out in Article 1(1) of Directive 2008/63/EC;Amendment
deleted
#950 Article 4 – point 33 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 33
Text proposed by the Commission
(33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply;Amendment
deleted
#954 Article 4 – point 34 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 34
Text proposed by the Commission
(34) ‘web browser’ means web browser as defined in Article 2(11) of Regulation (EU) 2022/1925;Amendment
deleted
#956 Article 4 – point 35 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 35
Text proposed by the Commission
(35) ‘media service’ means a media service as defined in Article 2(1) of Regulation (EU) 2024/1083;Amendment
deleted
#957 Article 4 – point 36 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 36
Text proposed by the Commission
(36) ‘media service provider’ means a media service provider as defined in Article 2(2) of Regulation (EU) 2024/1083;’Amendment
deleted
#958 Article 4 – point 37 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 37
Text proposed by the Commission
(37) ‘online interface’ means an online interface as defined in Article 3(m) of Regulation (EU) 2022/2065.’Amendment
deleted
#974 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38
Text proposed by the Commission
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.Amendment
(38) “scientific research” means any research which can also support competitiveness, innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.
#1034 Article 9 – paragraph 1 – point a (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 1 – point a
Text proposed by the Commission
(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.Amendment
(l) processing of biometric data is strictly necessary for the purpose of confirming the identity of a data subject using one-to-one verification, where the biometric data or the means needed for the recognition is under the sole control of the data subject and occurs on the data subject's device, except in highly exceptional cases where this is strictly necessary, proportional and uses state of the art privacy preserving technology, such as encryption and zero knowledge proofs.
noyb's comment:
The amendment slightly improves the Commission's proposal, which allows new types of processing.
#1060 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 5
Text proposed by the Commission
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Amendment
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, taking into account technical feasibility, available resources, the nature of the AI system or model, and state of the art technology, the controller shall in any event take appropriate measures proportionate to the risks posed without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.
noyb's comment:
The amendment proposes a provision making the obligations for controllers lighter.
#1081 Article 12 – paragraph 5 (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5
Text proposed by the Commission
Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either:Amendment
Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests where the controller is able to demonstrate an abusive intention where the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either:
noyb's comment:
The amendment reflects the current regime, as interpreted in CJEU, C-526/24 Brillen Rottler.
#1109 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 4
Text proposed by the Commission
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.Amendment
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has, or the data controller has taken reasonable steps available to it, taking into account relevant technical and organisational means to provide the data subject with the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other data processors or controllers, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.
noyb's comment:
Building upon the Commission’s proposal, apparently, this amendment also allows for further cases where no information to data subjects is provided. The proposal adds some unclear requirements / factors, that increase legal uncertainty even more.A lack of information typcially violates the "fairness" principle in Article 8(2) of the Charter.
#1126 Article 13 – paragraph 5 (Article 3 – paragraph 1 – point 6)
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 5
Text proposed by the Commission
5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.Amendment
5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort, taking into account the relevant technical and organisational circumstances, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.
noyb's comment:
This proposal builds upon the Commission's proposal, but apparently even tries to broaden the scope of the exemption.
#1146 Article 22 – paragraph 1 – point a (Article 3 – paragraph 1 – point 7)
Authored by
Regulation (EU) 2016/679
Article 22 – paragraph 1 – point a
Text proposed by the Commission
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means;Amendment
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means, when several equally effective automated processing solutions exist, the controller should use the less intrusive one when it does not result in a significant additional administrative burden for the controller;
noyb's comment:
The fact that a controller has to use the least intrusive means is an expression of the proportionality principle in Article 52 CFR. Waiving this principle in favour of avoiding additional administrative burden potentially violates this principle.
#1207 Article 35 – paragraph 4 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 4
Text proposed by the Commission
4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.Amendment
4. The Board shall prepare and publish a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.
noyb's comment:
Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.
#1212 Article 35 – paragraph 4 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 4
Text proposed by the Commission
5. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.Amendment
5. The Board shall prepare and publish a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.
noyb's comment:
Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.
#1219 Article 35 – paragraph 6 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 6
Text proposed by the Commission
6. The Board shall prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments.Amendment
6. The Board shall prepare and make public a proposal for a common template and a common methodology for conducting data protection impact assessments.
noyb's comment:
Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.
#1226 Article 35 – paragraph 6 (Article 3 – paragraph 1 – point 9 – point b)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 6
Text proposed by the Commission
6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).Amendment
6a. The lists referred to in paragraphs 4 and 5 and the template and methodology referred to in paragraph 6 shall be made public to the Commission within [OP date = 9 months of the entry into application of this Regulation].
noyb's comment:
This amendment seems to be related to an amendment shifting competences to the EDPB. This has no significant impact on the level of privacy or simplification.
#1228 Article 35 – paragraph 6 (Article 3 – paragraph 1 – point 9 – point b)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 6
Text proposed by the Commission
6b. The lists and the template and methodology referred to in paragraph 6a- shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6a.Amendment
6b. The lists and the template and methodology referred to in paragraph 6a shall be reviewed at least every three years and updated where necessary.
noyb's comment:
This amendment seems to be related to an amendment shifting competences to the EDPB. This has no significant impact on the level of privacy or simplification.
#1232 Article 35 – paragraph 6c (Article 3 – paragraph 1 – point 9 – point b)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 6c
Text proposed by the Commission
6c. Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Commission adopts the implementing act referred to in paragraph 6a.Amendment
6c. Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid.
noyb's comment:
No significant change to the level of data protection or simplification.
#1361 Article 88a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a
Text proposed by the Commission
Article 88aAmendment
deleted
#1449 Article 88b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b
Text proposed by the Commission
Article 88bAmendment
deleted
#1591 Article 88c – paragraph 2a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2a (new)
Text proposed by the Commission
Amendment
In Article 88c, the following paragraph is added: '2a. When assessing the compliance of processing for the development, testing, validation or operation of artificial intelligence systems, competent authorities shall take due account of the actual availability of harmonised standards, common specifications, technical guidance and supporting compliance tools necessary for the effective implementation of the applicable obligations. The application timeline for high-risk AI obligations should be aligned with the actual current availability of technical standards and supporting tools.'
noyb's comment:
This amendment proposes further obligations for competent authorities, without a specific enforcement tool for data subjects.
#1593 Article 88d (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88d (new)
Text proposed by the Commission
Amendment
After Article 88c, the following article is inserted: 'Article 88d 1. The Commission and the European Data Protection Board shall develop voluntary, standardised and machine-readable templates tailored to SMEs for the fulfilment of information, documentation and notification obligations under this Regulation. 2. Supervisory authorities shall provide accessible and proportionate guidance channels for SMEs, taking due account of their administrative and financial capacity when determining practical compliance measures. 3. The measures referred to in paragraphs 1 and 2 shall be without prejudice to the responsibility of controllers and processors to comply with this Regulation.'
noyb's comment:
Templates would reduce the administrative burden in creating the required documentation for SMEs
#1717 Article 5 – paragraph 3 (Article 5 – paragraph 1 – point 2 – introductory part)
Authored by
Directive 2002/58/EC
Article 5 – paragraph 3
Text proposed by the Commission
2. After Article 5(3), the following subparagraph is added:Amendment
2. In Article 5, paragraph 3 is replaced by the following paragraph:
#1727 Article 5 (Article 5 – paragraph 1 – point 2)
Authored by
Regulation 2002/58/EC
Article 5
Text proposed by the Commission
This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.Amendment
Article 5 is replaced by the following: 1. Member States shall ensure that the storing of information, or gaining access to information already stored, in the terminal equipment of a user of a service or a subscriber of a service can only be done based on consent of said user or subscriber, in accordance with Regulation 2016/679. 2. The storing of information, or gaining access to information already stored, in the terminal equipment of a subscriber or user of a specific service and the subsequent processing of personal data for the same purpose shall only be lawful without obtaining consent to the extent that is strictly necessary and solely related for the following purposes: (a) carrying out the transmission of an electronic communication over an electronic communications network; (b) providing a service requested by the user or subscriber, as well as its full functionality and personalisation; including the storing of or access to data strictly necessary for the provision of content such as personalisation or recommendation of content, the management of a digital subscription, or the maintenance of a user session; (c) measuring the audience of an online service by creating aggregated information about the usage of that online service, also by a third party, provided that the measuring does not involve repurposing of said data for profiling, advertising, or other privacy intrusive purposes and is subject to relevant safeguards; (d) measuring the audience of an online service by a trade association or its mandated measurement entity on behalf of one or more media service providers for joint audience measurement purposes in accordance with Article 24 of Regulation (EU) 2024/1083, subject to appropriate technical and organisational safeguards; or by a third party acting on behalf of the controller of that online service pursuant to a contractual arrangement with that controller, solely for the purpose of measuring the audience of that online service; or by an entity belonging to the same digital ecosystem as the controller of that online service, for the purpose of measuring the audience of services within that digital ecosystem; (e) ensuring the security of the information society service or of the electronic communications network, provided that it is strictly necessary, proportionate, subject to appropriate safeguards, and only limited to information strictly necessary for this purpose and does not involve any general scanning or monitoring of information stored in the terminal equipment of a user or subscriber; (f) preventing fraud directly related to the use of the specific service requested by the user, provided that such processing is strictly necessary, proportionate, subject to appropriate safeguards, limited to the smallest amount of data required for the purpose, and does not involve any general scanning or monitoring of information stored in the terminal equipment of a user or subscriber; (g) provision, displaying and measurement of such advertising that is solely based on the content immediately displayed to the subscriber or user while using said service, no form of profiling or other privacy intrusive technologies shall be used. 3. The subscriber or user shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means. If the subscriber or user gives consent, the provider shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the subscriber or user. 4. Nothing in this Article shall prevent a media service provider from conditioning access to its service upon the data subject’s consent to the processing of personal data for one or more specified purposes, or upon the payment of a reasonable fee for an equivalent version of the service that does not involve such processing. The specified purposes may include, but are not limited to, advertising, service improvement, product development, and analytics. Where such a choice is offered, both options must be presented to the data subject with equal prominence, in clear and plain language, and without the use of dark patterns.
noyb's comment:
Broader exceptions than the current legal framework for not obtaining consent. The deceptive practices fully the standard of the Commission, while a payment with data is directly foreseen.