António Tânger Corrêa

Text proposed by the Commission

Amendment

(4a) Recent developments have demonstrated that advanced digital services, including data processing, cloud computing and artificial intelligence systems, may be subject to unilateral restrictions, export controls, licensing limitations or other measures adopted by third-country authorities. Such measures may lead to the interruption, degradation or withdrawal of services provided to users established in the Union, irrespective of their contractual rights. In view of the strategic importance of artificial intelligence and data-processing capabilities, excessive dependence on providers exposed to such measures may pose risks to the Union’s economic security, technological sovereignty, research capacity and industrial resilience, in particular where the services concerned process or rely on high-value datasets, including trade secrets, industrial know-how, research data, strategic business information or data originating from natural persons, whether in identifiable, pseudonymised or otherwise non-identifiable form. It is therefore appropriate to mitigate such dependencies through interoperability, portability and switching measures, business continuity arrangements, privacy-preserving technologies and appropriate technical and contractual safeguards against unilateral service disruption or termination, including ‘kill switch’ scenarios. Such measures should apply irrespective of the degree of integration of the services concerned or of the legal status of the entities concerned under Union law, including data intermediation services and recognised data altruism organisations.

Justification

The recent suspension of access to advanced AI models under export-control measures has made concrete the risk of unilateral interruption decided by a third-country authority. This recital establishes the need for resilience measures introduced in the operative part on an effect-based basis (dependency, switchability, jurisdictional exposure).

noyb's comment:

Can have an impact on future interpretation, but no direct impact on the law when it comes to B2B relations, empowering most controllers versus large processors. Highlighting the option for a 'kill switch' can also be relevant from a privacy perspective.

#188 Recital 24 b (new)

Authored by

Text proposed by the Commission

Amendment

(24b) In accordance with Regulation (EU) 2016/679, the principles of data protection should not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person, or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. Re-identification of data subjects from anonymised datasets should be prohibited. This should not prejudice the possibility to conduct research into anonymisation techniques, in particular for the purpose of ensuring information security, improving existing anonymisation techniques and contributing to the overall robustness of anonymisation, undertaken in accordance with Regulation (EU) 2016/679.

Justification

The prohibition of re-identification is the necessary corollary of any anonymisation regime. Its disappearance with the repeal of the DGA would leave the new definition of anonymised data without a sanction for its circumvention.

noyb's comment:

If a data subject is no longer identifiable, that should mean that re-identification is impossible. Thus true anonymisation should not necessitate safeguards such as highlighted in this proposal.

#236 Recital 28

Authored by

Text proposed by the Commission

(28) In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as methodological and systematic approach applied while conducting the research in the specific area. Research and technology development should be conducted in academic, industry and other settings, including small and medium-sized undertakings, (Article 179(2) TFEU) and should be always of a of high quality and should adhere to the principles of principles of reliability, honesty, respect and accountability (verifiability).

Amendment

(28) Scientific research should not include the profiling of natural persons, direct marketing, the monitoring of individuals' behaviour, or activities whose purpose is to influence or nudge the behaviour of natural persons, even where such activities apply scientific methods. The ethical standards of the relevant research area should be understood as those established within a recognised scientific discipline, and not as standards defined unilaterally by the controller for the purposes of a given processing operation. In order to assess whether research meets the conditions of scientific research for the purpose of this Regulation, account can be taken of elements such as methodological and systematic approach applied while conducting the research in the specific area. Research and technology development should be conducted in academic, industry and other settings, including small and medium-sized undertakings, (Article 179(2) TFEU) and should be always of a of high quality and should adhere to the principles of principles of reliability, honesty, respect and accountability (verifiability).

Justification

The broadening of research purposes must not allow processing whose principal object is behavioural targeting to be re-labelled as scientific research. Nor may the notion of 'research area' be defined by the controller itself: the ethical standards invoked must be those of a recognised discipline, failing which the safeguard is circular.

noyb's comment:

More criteria to exlude certain problematic processing activities for scientific reserach purposes are added.

#242 Recital 28 a (new)

Authored by

Text proposed by the Commission

Amendment

(28a) Research data, and in particular data concerning health, constitute a strategic asset for the Union and, at the same time, one of the most sensitive categories of personal data. Their processing for scientific research purposes should be subject to the safeguards laid down in Article 89(1), including data minimisation, pseudonymisation and, wherever the purpose of the research can be achieved without processing personal data, anonymisation. Their transfer to third countries, or their processing by providers exposed to extraterritorial measures, may create risks both for the data subjects concerned and for the research capacity of the Union, and should accordingly be accompanied by appropriate technical, organisational and contractual safeguards.

Justification

Health and research data raise a twofold issue: protection of individuals and strategic autonomy. The recital connects the two, consistently with the resilience approach in recital 4a.

noyb's comment:

Mere repitition of current GDPR requirements.

#250 Recital 29 a (new)

Authored by

Text proposed by the Commission

Amendment

(29a) Reliance on legitimate interest within the meaning of Article 6(1)(f) requires three cumulative conditions to be met: the pursuit by the controller or by a third party of an interest which is lawful, clearly and precisely articulated, and real and present rather than speculative; the necessity of the processing for that interest, which cannot reasonably be achieved by other means less intrusive for the data subject, including through the use of anonymised data; and the absence of an overriding of that interest by the interests or fundamental rights and freedoms of the data subject, having regard to the nature of the data, the context of the processing, its consequences, and the reasonable expectations of the data subject based on their relationship with the controller. Where those interests or rights would override the interest pursued, the controller may implement mitigating measures; where such measures are insufficient, the processing may not be based on that provision.

Justification

Codifies the three-condition test consistently applied by the Court and by the Board.

noyb's comment:

The proposed text codifies the three-condition test applied by the CJEU and by the European Data Protection Board (Guidelines 01/2024). No matrial change.

#309 Recital 33 a (new)

Authored by

Text proposed by the Commission

Amendment

(33a) The processing of personal data within an AI regulatory sandbox established pursuant to Regulation (EU) 2024/1689, or in the course of testing in real-world conditions, remains subject in full to Regulation (EU) 2016/679. Participation in a sandbox does not constitute a legal basis for processing, nor does it exempt the controller from the balancing test, from the obligation to carry out a data protection impact assessment, or from the rights of data subjects. The requirements of human oversight laid down in Article 14 of Regulation (EU) 2024/1689, and the classification of a system as high-risk under that Regulation, apply in addition to, and not in substitution for, the safeguards of Regulation (EU) 2016/679.

Justification

Clarifies the interplay between AI sandboxes and real-world testing and GDPR Regulation.

noyb's comment:

The proposed amendment explains the interplay between regulatory sandboxes and the application of the GDPR.

#330 Recital 35

Authored by

Text proposed by the Commission

(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. By contrast, it should be clarified in Article 12 of the Regulation that the right of access, which is from the outset favourable to data subjects, should not be abused in the sense that the data subjects abuse them for purposes other than the protection of their data. For example, such an abuse of the right of access would arise where the data subject intends to cause the controller to refuse an access request, in order to subsequently demand the payment of compensation, potentially under the threat of bringing a claim for damages. Other examples of abuse include situations where data subjects make excessive use of the right of access with the only intent of causing damage or harm to the controller or when an individual makes a request, but at the same time offers to withdraw it in return for some form of benefit from the controller. Moreover, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive conduct of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abuse only to a reasonable level. In any event, while requesting access under Article 15 of Regulation (EU) 2016/679 the data subject should be as specific as possible. Overly broad and undifferentiated requests should also be regarded as excessive.

Amendment

(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. By contrast, it should be clarified in Article 12 of the Regulation that the right of access, which is from the outset favourable to data subjects, should not be abused in the sense that the data subjects abuse the means at their disposal to enforce the rights conferred by this Regulation for purposes unrelated to the protection of their data. A request may in particular be regarded as excessive where those means are used for the purpose of obtaining commercially sensitive information or gaining insight into the internal processes of the controller, including for the benefit of an undertaking competing with the controller, of exerting pressure in unrelated proceedings, or of disrupting the administrative operations of the controller by imposing a manifestly disproportionate burden. Conversely, the exercise of the rights conferred by this Regulation for the purpose of verifying, in good faith, whether a controller complies with this Regulation shall not be regarded as unfounded or excessive, irrespective of whether those rights are exercised individually or with the assistance of, or through, a body referred to in Article 80. For example, such an abuse of the right of access would arise where the data subject intends to cause the controller to refuse an access request, in order to subsequently demand the payment of compensation, potentially under the threat of bringing a claim for damages. Other examples of abuse include situations where data subjects make excessive use of the right of access with the only intent of causing damage or harm to the controller or when an individual makes a request, but at the same time offers to withdraw it in return for some form of benefit from the controller. Moreover, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive conduct of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abuse only to a reasonable level. In any event, while requesting access under Article 15 of Regulation (EU) 2016/679 the data subject should be as specific as possible. Overly broad and undifferentiated requests should also be regarded as excessive.

Justification

The notion of 'abuse of rights' is an autonomous concept of Union law which the Court applies with extreme caution; invoking it against a fundamental right would be disproportionate and legally exposed. What is targeted is the instrumental use of the procedural means, not the right itself. The good-faith compliance-verification safeguard, anchored in Article 80, expressly protects citizen and non-profit scrutiny.

noyb's comment:

The amendment goes further than the restrictions proposed by the Commission.

#343 Recital 36

Authored by

Text proposed by the Commission

(36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller. These should be the situations where the context of the relationship between the controller and the data subject is very clear and circumscribed and the controller’s activity is not data-intensive, such as the relationship between a craftsman and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment. In such circumstances, that is to say when the processing is non data-intensive, non-complex and where the controller collects a low amount of personal data, it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679. The same should apply to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.

Amendment

(36) Article 13 of Regulation (EU) 2016/679 requires the data controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of data controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of the Regulation, this derogation should be extended to situations where the processing is not likely to result in a high risk, within the meaning of Article 35 of the Regulation, and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1 in the light of the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller. These should be the situations where the context of the relationship between the controller and the data subject is very clear and circumscribed and the controller’s activity is not data-intensive, such as the relationship between a craftsman and their clients, where the scope of processing is limited to the minimum data necessary to perform the service. The controller’s activity is not data-intensive where it collects a low amount of personal data and its processing operations are not complex, which is not the case, for example, in the field of employment. The same applies to associations, sport clubs, and micro, small and medium-sized enterprises where the processing of personal data is confined to the management of membership, communication with members, the organisation of activities, or the performance of a contract with the data subject. The derogation does not apply where the controller engages in the collection of personal data from third parties, in their purchase, aggregation, enrichment, sale or making available to third parties for commercial purposes, such activities being by nature data-intensive. In such circumstances, that is to say when the processing is non data-intensive, non-complex and where the controller collects a low amount of personal data, it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller as well as on the purpose of the processing when that processing is carried out for the performance of a contract to which a data subject is a party, or when the data subject has given his or her consent to that processing, in accordance with the requirements laid down in Regulation (EU) 2016/679. The same should apply to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.

noyb's comment:

This proposal further elaborates on the Commission's proposal regarding an additional exemption from the information obligation in Article 13 GDPR. However, the provision is in particular unworkable for the SMEs which are supposed to be the beneficiaries of the provision.

#348 Recital 36 a (new)

Authored by

Text proposed by the Commission

Amendment

(36a) Article 22(1) confers on the data subject the right not to be subject to such a decision. That right is a prohibition of principle, subject to the limited exceptions laid down in Article 22(2), and not an authorisation subject to conditions. The safeguards laid down in Article 22(3), and in particular the right to obtain human intervention, to express one's point of view and to contest the decision, apply in full. The requirements of human oversight laid down in Article 14 of Regulation (EU) 2024/1689 apply in addition to, and not in substitution for, those safeguards.

noyb's comment:

This highlights the positive clarifications by the CJEU (SCHUFA II) regarding this Article. It also pushes back to the commission’s draft, framing Article 22 as an authorisation subject to conditions.

#371 Recital 38

Authored by

Text proposed by the Commission

(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.

Amendment

(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. Article 22(1) confers on the data subject the right not to be subject to such a decision. That right is a prohibition of principle, subject to the limited exceptions laid down in Article 22(2), and not an authorisation subject to conditions. Where the controller relies on the necessity of the decision for entering into, or the performance of, a contract, that necessity shall be interpreted strictly. A decision is not necessary within the meaning of that provision where the purpose pursued can reasonably be achieved by means involving human intervention. The availability of an equally effective non-automated alternative excludes reliance on that exception. When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The safeguards laid down in Article 22(3), and in particular the right to obtain human intervention, to express one's point of view and to contest the decision, apply in full.

noyb's comment:

Positive codification of case law and legal doctrine.

#393 Recital 40 a (new)

Authored by

Text proposed by the Commission

Amendment

(40a) Where, in respect of the same processing operation, a controller is required to carry out a data protection impact assessment under Article 35 of Regulation (EU) 2016/679 and is also subject to an obligation to carry out a fundamental rights impact assessment under Article 27 of Regulation (EU) 2024/1689, or to a reporting obligation in respect of automated monitoring or decision-making systems under other Union law, those obligations may be satisfied by means of a single integrated assessment. Such an assessment satisfies each of those obligations only where it covers all the elements required by each applicable provision; the substantive requirements, thresholds and triggering conditions laid down in those provisions remain unaffected. The integrated assessment should be made available to each competent authority within the framework of its respective competences and should not be required to be submitted to a single authority. The single Union list of processing operations subject to a data protection impact assessment should reflect processing operations presenting genuinely high risks to the rights and freedoms of natural persons, and should not consist of the accumulation of the requirements laid down in national lists.

Justification

Vertically integrated operators face a triple documentation burden for one and the same activity. The amendment mutualises the documentary instrument.

noyb's comment:

Combining the DPIA with other assessments like the FRIA could reduce administrative burden of controllers. Highlighting that the black-list should not consist of an accumulation of national lists could be interpreted as pushing to reduce the scope of required DPIAs.

#1013 Article 6 – Paragraph 1a (new) (Article 3 – paragraph 1 – point 2 d (new))

Authored by

Regulation (EU) 2016/679
Article 6 – Paragraph 1a (new)

Text proposed by the Commission

Amendment

2d. In Article 6, the following paragraph 1a is inserted: '(1a) For the purposes of paragraph 1, the creation of a permanent user account or the provision of personal data by the data subject may be required to access offers or to purchase goods or services only where strictly necessary. Where such access or purchase can be ensured without it, the controller shall offer the data subject a clear, easily accessible and non-discriminatory means to proceed, which shall not give rise to less favourable conditions for the data subject.'

Justification

Making access to an offer or the purchase of goods or services conditional on the creation of a permanent user account which is not necessary for the contract deprives consent of its free character, contrary to Article 7(4). The amendment requires the controller to offer a clear, easily accessible and non-discriminatory means to proceed without such an account, which may not give rise to less favourable conditions for the data subject. This is the 'guest experience' which the Court of Justice has already held to be required in comparable circumstances.

noyb's comment:

The proposed text includes an additional safeguard.

#1017 Article 7a (new) (Article 3 – paragraph 1 – point 2 g (new))

Authored by

Regulation (EU) 2016/679
Article 7a (new)

Text proposed by the Commission

Amendment

2g. The following Article 7a is inserted: 'Article 7a Consent interfaces 1. Any interface used to request, give, refuse or withdraw consent under this Regulation, including for the storing of, or access to, information in terminal equipment, shall be fair, neutral, intelligible and easily accessible. 2. Consent shall be freely given, specific, informed and unambiguous. It shall be requested separately for each purpose and require a statement or clear affirmative action. Silence, inactivity, pre-ticked boxes or the mere continued use of a service shall not constitute consent. Fresh consent shall be required for any other purpose. 3. Consent shall not be freely given where the data subject has no genuine choice, cannot refuse or withdraw consent without detriment, including in the presence of a clear imbalance between the data subject and the controller, or where access to a service, its functionalities or an equivalent version thereof is made conditional on consent to processing, storing or access that is not necessary for that service. 4. Before consent is given, the data subject shall receive, in clear and plain language, information on the controller, any joint controllers, recipients or categories of recipients relying on the consent, the purposes pursued, the categories of data concerned, the right to withdraw consent, and, where relevant, automated decision-making under Article 22 or transfers to a third country without an adequacy decision or appropriate safeguards. Consent requests shall be clearly distinguishable from other matters and shall not be concealed within general terms and conditions. 5. Consent interfaces shall not deceive, coerce or manipulate the data subject, give greater prominence to acceptance than to refusal, make refusal, withdrawal or non-consent options less easy, less accessible or more time-consuming than acceptance, or repeat requests in a manner liable to pressure the data subject. Where an option to accept is presented, an equivalent option to refuse shall be presented at the same level of the interface. 6. Refusing or withdrawing consent shall be as easy as giving consent and shall not entail any cost, disadvantage or degradation of the service. Where consent was given through an electronic interface, withdrawal shall be possible through the same interface. Following withdrawal, the controller shall cease the processing concerned and, in the absence of another lawful basis, erase the data concerned. 7. Where consent is withdrawn or found to be invalid, the controller shall not retroactively rely on another legal basis under Article 6 to justify the same processing. 8. The controller shall be able to demonstrate that valid consent was given. The information retained for that purpose shall be limited to what is necessary. 9. Where this Regulation requires explicit consent, consent shall be given by an express statement.'

Justification

Codifies the EDPB Guidelines 05/2020 on consent and 03/2022 on deceptive design patterns. Consent must be freely given, specific, informed and unambiguous; the interface must be fair and neutral and must not give visual or other prominence to acceptance over refusal, whether through size, colour, positioning or wording; refusal must be as easy to exercise, and as prominent, as acceptance; consent must be capable of being withdrawn as easily as it was given; and the controller may not retroactively rely on another legal basis where consent is withdrawn or found invalid. Consent obtained through a manipulated interface is not consent.

noyb's comment:

Different clarifications, also case-law reflected here.

#1038 Article 9 – paragraph 2 (Article 3 – paragraph 1 – point 3 – point a)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 2

Text proposed by the Commission

(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.

Amendment

(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the one-to-one verification is under the sole control of the data subject.

noyb's comment:

The amendment supports the Commission's proposal.

#1046 Article 9 – paragraph 2a (new) (Article 3 – paragraph 1 – point 3 – point a a (new))

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 2a (new)

Text proposed by the Commission

Amendment

(aa) In Article 9, the following paragraph is inserted: '2a. Points k and k under paragraph 2 shall not apply to data concerning health, genetic data, biometric data for the purpose of uniquely identifying a natural person, or personal data used to infer health status, unless such processing is expressly authorised by Union or Member State law and subject to prior consultation with the competent supervisory authority.'

noyb's comment:

Limits, but also accepts the additions in (k) proposed by the Commission.

#1052 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 5

Text proposed by the Commission

Amendment

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data, without undue delay. In assessing whether the removal of those data requires a disproportionate effort, account shall be taken of the state of the art, the costs of implementation, the volume of data concerned, the technical feasibility of isolating or extracting the data, and the nature, scope and purposes of the processing. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data is technically impossible despite documented state-of-the-art measures, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, or re-used for AI outputs, profiling, advertising or other purposes, and from being disclosed or otherwise made available to third parties. In assessing whether the removal of those data requires a disproportionate effort, account shall be taken of the state of the art, the costs of implementation, the volume of data concerned, the technical feasibility of isolating or extracting the data, and the nature, scope and purposes of the processing; or re-used for AI outputs, profiling, advertising or other purposes,

Justification

A general AI derogation should not create a route for the incidental use of patient or health-related data. Health data require a specific legal basis, stronger safeguards and effective supervisory oversight. The same carve-out should be reflected in proposed Article 88c on legitimate interests for AI processing.

noyb's comment:

Reiterates a limitations that would typically already apply under the general principles in the current text of the GDPR. Some matters like the "technical impossibility" are currently not a defense for controllers (so far the processing is then simply not possible) and are added here.

#1054 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 5

Text proposed by the Commission

Amendment

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties. The controller shall apply effective technical and organisational measures to prevent their inference, disclosure or use. Those measures shall reflect the state of the art and shall include, as appropriate, the filtering and removal of such data from training, testing and validation datasets, pseudonymisation and key separation, and technical measures preventing their inference, regurgitation or disclosure through the outputs of the AI system or model; their application shall be proportionate to the risk and shall be documented by the controller.

noyb's comment:

The amendment rephrases the Commission's proposal, while adding some examples of technical measures.

#1063 Article 9 – paragraph 5a (new) (Article 3 – paragraph 1 – point 3 – point b)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 5a (new)

Text proposed by the Commission

Amendment

5a. 'Where the processing referred to in point k of paragraph 2 is carried out in the context of an AI regulatory sandbox established under Article 57 of Regulation (EU) 2024/1689, or in the context of testing in real world conditions under Article 60 of that Regulation, the processing shall comply with the conditions and safeguards laid down, respectively, in Article 59 and in Articles 60 and 61 of that Regulation. In particular, the personal data shall be processed in a functionally separate, isolated and protected environment under the control of the controller; effective monitoring and response mechanisms shall be in place to identify and mitigate high risks to the rights and freedoms of the data subjects and, where necessary, to stop the processing; and any personal data shall be deleted once the participation in the sandbox or the testing has terminated.'

Justification

The processing of personal data for the development of AI systems must be accompanied by robust safeguards, in particular as regards special categories of personal data. This amendment specifies the organisational and technical measures to be implemented, provides objective criteria for assessing whether the removal of inadvertently collected special categories of data would require a disproportionate effort, and subjects the removal itself to a requirement of promptness. It further establishes a graduated approach: where the processing takes place within an AI regulatory sandbox or in the course of testing in real world conditions, it must comply with the conditions and safeguards laid down, respectively, in Articles 59, 60 and 61 of Regulation (EU) 2024/1689, thereby importing the risk-control mechanisms of that Regulation — isolated processing environments, effective monitoring and response mechanisms, and deletion upon completion. Where the controller is a small or medium-sized enterprise or a small mid-cap, the measures are to be applied in a manner adapted to its capacities, without reducing the protection afforded to data subjects. This ensures coherence with the Artificial Intelligence Act while supporting innovation, in particular by smaller Union operators.

noyb's comment:

The proposed amendment does add slightly what is already lex specialis in the AI Act.

#1165 Article 30 – Paragraph 1 – point ga (new) (Article 3 – paragraph 1 – point 7 a (new))

Authored by

Regulation (EU) 2016/679
Article 30 – Paragraph 1 – point ga (new)

Present text

(new)

Amendment

7a. In Article 30, paragraph 1, the following point ga is added: "(ga) where personal data are collected from a third party, purchased, aggregated, enriched, sold or otherwise made available to third parties for commercial purposes, the categories of data providers and of data recipients, the categories of data concerned, the purposes pursued, the legal basis relied upon, and the elements demonstrating the lawful origin of the data and of their making available. The identity of the providers and recipients concerned shall be retained by the controller and made available to the supervisory authority upon request."

noyb's comment:

The proposed text seeks to codify additional safeguards in the GDPR. This would lead to additional documentation duties.

#1169 Article 29a (new) (Article 3 – paragraph 1 – point 7 b (new))

Authored by

Regulation (EU) 2016/679
Article 29a (new)

Present text

(new)

Amendment

7b. The following article is added: "Article 29a Application of pseudonymisation and identification of a natural person : 1. Controllers and processors may apply pseudonymisation in order to reduce the risks to the data subjects concerned and to comply with their obligations under this Regulation, in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information. The Commission may adopt implementing acts to specify means and criteria to determine whether a natural person is identifiable, including through personal data having undergone data resulting from pseudonymisation, account shall be taken of all the means reasonably likely to be used, such as singling out or online identifiers, either by the controller or by another person to identify the natural person directly or indirectly no longer constitutes personal data for certain entities. 2. The application of pseudonymisation to personal data may, depending on the circumstances of the case and provided that appropriate technical and organisational measures are put in place and are such as to prevent the data in question from being attributed to the data subject, effectively prevent persons other than the controller from identifying the data subject in such a way that, for them, the data subject is not or is no longer identifiable. 3. Where a person other than the controller referred to in paragraph 2 discloses, transmits or otherwise makes such data available to a third party and it cannot be ruled out that this third party possesses or can obtain means reasonably likely to enable the data subject to be identified, both the transmission of the data to this third party and the subsequent processing of the data by this third party is to be considered as processing of data relating to an identifiable natural person."

noyb's comment:

Pseudonymisation is an unreliable safeguard in preventing identification of a data subject. Further, wording such as “reasonably likely to be used” allows for an unclear, subjective and circumstantial definition of personal data.

#1191 Article 33 – Paragraph 6 (Article 3 – paragraph 1 – point 8 – point c)

Authored by

Ewa Zajączkowska-Hernik

Regulation (EU) 2016/679
Article 33 – Paragraph 6

Text proposed by the Commission

Amendment

6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The common template shall include fields enabling the controller to describe any privacy-enhancing measures relevant to the breach, including encryption, pseudonymisation, federated or local processing, confidential computing, access controls, logging, and measures taken to prevent model memorisation, regurgitation, or unauthorised disclosure. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2). Where the Commission departs from the proposal submitted by the Board, it shall state the reasons for doing so. Those reasons shall be made publicly available together with the implementing act.

noyb's comment:

No substantial amendment of the Commission’s proposal regarding the list and template the EDPB is supposed to prepare.

#1438 Article 88a – paragraph 4 – points a, b, c, d and da, db, dc (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4 – points a, b, c, d and da, db, dc (new)

Text proposed by the Commission

Amendment

In Article 88a, paragraph 4, points a, b, c, d are replaced by the following: '(a) Freedom: consent shall be given freely, the data subject having a genuine choice to refuse or withdraw it without detriment, and neither a contract, a service, nor access to its functionalities shall be made conditional on consent to storage or access that is not necessary for that service; (b) Specificity: consent shall be given separately for each specified, explicit and legitimate purpose, a distinct opt-in being provided for each; (c) Information: prior to giving consent, the data subject shall be informed, in clear and plain language, of at least the controller's identity, the purpose of each processing operation, the data used, and the right to withdraw consent at any time; (d) Unambiguity: consent shall be given by a statement or clear affirmative action, silence, inactivity, pre-ticked boxes or mere continued use of a service not constituting consent;' The following points are added: (da) Fair design: the interface used to give, refuse or withdraw consent shall be fair and neutral, and shall not give prominence to acceptance over refusal or otherwise impair the data subject's ability to decide freely; (db) Withdrawal: the data subject shall be able to withdraw consent at any time, as easily and through the same interface as it was given, free of charge and without degradation of the service; (dc) Demonstrability: the controller shall be able to demonstrate that valid consent was given, retaining no more information than necessary for that purpose.'

Justification

avoid hard-coded consent UX mandates sources guidelines EDPB 05/2020

noyb's comment:

Restates the general conditions of consent, but ads the fair design idea, which is more abstract and hence applicable to more situations than the Commission proposal.

#1440 Article 88a – paragraph 4a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4a (new)

Text proposed by the Commission

Amendment

(4a) In Article 88a, the following paragraph 4a is inserted: '4a. The Board shall encourage stakeholders to develop cross-device,, interoperable and ergonomic interfaces that address consent fatigue, while taking into account the economic balance of all the stakeholders concerned, by exploring possibilities such as: (a) enabling the data subject to refuse requests for consent in an easy and intelligible manner, through a single-click button or equivalent means; (b) ensuring that, where the data subject gives consent, the controller does not make a new request for consent for the same purpose during the period in which it can lawfully rely on that consent; (c) ensuring that, where the data subject declines a request for consent, the controller does not make a new request for consent for the same purpose for a reasonable period.'

noyb's comment:

Waters down the Commission proposal, does not provide clarity for anyone and shifts the regulation to the private sector ("stakeholders" shall develop a solution).