Paulo Cunha

Text proposed by the Commission

(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.

Amendment

(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including which may include personal data and special categories thereof. Special categories of personal data may incidentally and residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing and while the controller did not intend to process such personal data and has taken the appropriate technical and organisational measures to avoid such processing, such as the filtering out of special categories of personal data at the collection stage. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, including technical capabilities derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed for incidental and residual processing of special categories of data in the context of the development and technical operation of AI systems or AI models. The derogation should not be understood as covering the processing of special categories of personal data directly acquired by or provided to the AI system or AI model in the course of the deployment. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle, such as the development and operation, of an AI system or AI model, and, once it identifies such data, effectively remove them. If removal would require manifestly disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model the controller should effectively protect such data from being further processed or processed for other purposes, in particular used to infer outputs, being disclosed or otherwise made available to third parties. The controller should document its assessment and have processes in place to monitor and demonstrate the effectiveness of these measures. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing, for example if special categories of personal data relating to a natural person’s voice, image or other personal characteristics are used in a way that goes beyond incidental or residual existence. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679 or in another Union law, such as Regulation (EU) 2024/1689 regarding the processing of special categories of personal data for the purpose of ensuring bias detection and correction. The notion of AI system and AI model should be understood in the same manner as in Regulation (EU) 2024/1689.

Text proposed by the Commission

Amendment

(40a) Regulation (EU) 2016/679 follows a technology-neutral, risk-based and purpose-driven approach to the processing of personal data. The lawfulness of processing should be determined by reference to a specific and legitimate purpose and an assessment of the risks posed to the rights and freedoms of natural persons, taking into account the nature, scope, context and purposes of the processing. Where personal data are processed through the terminal equipment of natural persons, and the available indicators demonstrate that the likelihood and severity of risks to those rights and freedoms are limited, reliance on legal bases other than consent may be justified, where appropriate.

Text proposed by the Commission

Amendment

(lb) In Article 9, paragraph 2, the following point is added: 'lb. processing is necessary and proportionate for the prevention of fraud, the detection and prevention of abuse, bot and spam activity, identity misuse, account takeover or payment fraud, or for ensuring the security of accounts, payments and transactions, provided that the processing is subject to appropriate safeguards for the rights and freedoms of the data subject.'

Text proposed by the Commission

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;

Amendment

(c) creating information about the usage of an online service solely for the use of the provider of that service;

Text proposed by the Commission

Amendment

(ca) In Article 83, paragraph 3, the following point ca is inserted: '(ca) performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083.'

Text proposed by the Commission

(d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

Amendment

(d) maintaining or restoring the security, integrity and functioning of a service provided by the controller and requested by the data subject or the security of the terminal equipment used for the provision of such service, including detecting, preventing or mitigating fraud, automated or non-human traffic, unauthorised access, misuse of the service, circumvention of technical access conditions, or other uses that are contrary to the provider’s terms and conditions

Text proposed by the Commission

Amendment

(da) In Article 88a, paragraph 3, the following point da is added: '(da) legitimate purposes in relation to contextual advertising, including measuring the performance and reach of such advertisement or capping the frequency with which such advertisement is being displayed.'

Text proposed by the Commission

Amendment

(db) In Article 88a, paragraph 3, the following point db is added: '(db) ‘legitimate interests’ according to Article 6(1)(f) of this regulation provided that the controller applies Privacy Enhancing Technologies (PETs) in accordance with the technical standards adopted pursuant to Article 25a. This point shall not apply to processing operations that involve tracking or profiling a data subject's behaviour for the purposes of behavioural advertising, regardless of whether there is a direct relationship with the data subject. This does not preclude the processing of data for internal product optimisation, provided such processing is not used to track the user.'

Text proposed by the Commission

Amendment

(3a) In Article 88b, the following paragraph is inserted: '3a. Where a data subject gives specific consent to a controller pursuant to Article 88a, such consent shall prevail over any conflicting automated or machine-readable indication referred to in paragraph 1.'