42 GDPR-relevant amendments by João Oliveira
#89 Recital 3
Authored by
Text proposed by the Commission
(3) Union digital legislation has evolved incrementally over the past years, in response to the rapidly growing footprint of digital technologies in the Union’s economy and societal dynamic, and in view of addressing emerging challenges and promoting business opportunities in the EU. Notwithstanding the Commission’s commitment to a systematic ‘stress test’ of the digital rules, along with other Union rules, which might lead to further regulatory adjustments notably following the forthcoming Digital Fitness Check, as well as other targeted evaluations of digital rules, immediate regulatory changes are necessary. Consequently, this Regulation proposes a first set of amendments to the digital legislative framework, aimed at providing immediate regulatory clarifications that stimulate innovation in the Union market, and that cut administrative compliance costs in particular for businesses, while also streamlining supervisory and administrative costs for supervisory authorities and advisory bodies. The amendments also seek to provide clarity to individuals.Amendment
(3) Union digital legislation has evolved incrementally over the past years, in response to the rapidly growing economic and social footprint of digital technologies in the Union. These developments highlight the need for clear and effective regulation of the use of personal and non-personal data. To that end, data protection should be made a central pillar and robust safeguards should be put in place for Union citizens and SMEs, including systematic ‘stress tests’ and targeted evaluations of digital rules, which could provide scope for future regulatory adjustments that are proportionate and consistent and maintain those objectives. Consequently, a proper assessment should be undertaken of administrative compliance costs, in particular for individuals and SMEs, as well as the main difficulties faced by national supervisory and oversight authorities in the digital sector.
#95 Recital 4
Authored by
Text proposed by the Commission
(4) Given the foundational role of data in driving value-creation in the digital economy, and pursuant to the objectives of the Communication for a European Data Union Strategy, the amendments presented in this Regulation to the legislative framework regarding data seek to build a coherent and cohesive regulatory framework for the availability and use of data, streamlining and consolidating the data regulatory framework into only two legal acts, namely Regulations (EU) 2016/6795 and (EU) 2023/28546 of the European Parliament and of the Council, from currently five different applicable acts. The amendments seek to cut unnecessary administrative costs and stimulate the availability of data as a prerequisite for supporting competitive digital businesses in the Union, while maintaining the highest standard of protections for privacy, personal data protection, and fair business practices, and ensuring core regulatory objectives, including compliance with EU and national competition law. _________________ 5 REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) 6 REGULATION (EU) 2023/2854 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act)Amendment
deleted
noyb's comment:
Pushback against the aim of "availability and use of data", relevant for future interpretation, but not any key change of the law.
#213 Recital 27
Authored by
Text proposed by the Commission
[...]Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#246 Recital 29
Authored by
Text proposed by the Commission
(29) It should be reiterated that further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. In such cases it is not necessary to ascertain on the basis of Article 6(4) of this Regulation whether the purpose of the further processing is compatible with the purpose for which the personal data are initially collected.Amendment
(29) It should be reiterated that further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. In such cases it is not necessary to ascertain on the basis of Article 6(4) of this Regulation whether the purpose of the further processing is compatible with the purpose for which the personal data are initially collected. Further processing should be carried out in accordance with the principles and appropriate safeguards of Regulation (EU) 2016/679, in particular Article 89 thereof. To that effect, technical and organisational measures should be put in place to ensure compliance with the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner.
noyb's comment:
The additions do not include any new substantive element that go beyond e.g. Article 5(1) or 24 of the GDPR.
#252 Recital 30
Authored by
Text proposed by the Commission
(30) Trustworthy AI is key in providing for economic growth and supporting innovation with socially beneficial outcomes. The development and use of AI systems and the underlying models such as large language models and generative video models rely on data, including personal data, in various phases in the AI lifecycle, such as the training, testing and validation phase and may in some instances be retained in the AI system or the AI model. The processing of personal data in this context may therefore be carried out for purposes of a legitimate interest within the meaning of Article 6 of Regulation (EU) 2016/679, where appropriate. This does not affect the obligation of the controller to ensure that the development or use (deployment) of AI in a specific context or for specific purposes complies with other Union or national law, or to ensure compliance where its use is explicitly prohibited by law. It also does not affect its obligation to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
deleted
noyb's comment:
This amendment simply proposes to not alter recitals of the GDPR to include AI technologies.
#270 Recital 31
Authored by
Text proposed by the Commission
(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, providing an unconditional right to object to the processing of their personal data, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#290 Recital 32
Authored by
Text proposed by the Commission
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR balances the right to protection of personal data, pursuant to Article 8 CFREU, with the freedom of science, pursuant to Article 13 CFREU. The processing of personal data for the purpose of scientific research therefore pursues a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, provided that such research is not contrary to Union or Member State law. This is without prejudice to the obligation of the controller to ensure that all other conditions of Article 6(1)(f) of Regulation (EU) 2016/679 as well as all other requirements and principles of that Regulation are met.Amendment
(32) The processing of personal data for scientific research purposes and the application of the GDPR’s provisions on scientific research are conditional on the adoption of appropriate safeguards for the rights and freedoms of data subjects, pursuant to Article 89(1) GDPR. To that end, the GDPR should aim to strike an appropriate and sensible balance between the right to protection of personal data, pursuant to Article 8 CFREU, and the freedom of science, pursuant to Article 13 CFREU, provided that the scientific research conducted is not contrary to Union or Member State law. Where the controller intends to process data in pursuit of a legitimate interest within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, it must ensure mandatory compliance with all of the conditions of that Article as well as all other requirements and principles of that Regulation.
noyb's comment:
Improvement over the COM proposal, but basically stating the current state of law. No improvement compared to the GDPR.
#306 Recital 33
Authored by
Text proposed by the Commission
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.Amendment
(33) The development of certain AI systems and AI models frequently involves the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order to safeguard the protection of personal data, particularly data that falls within the definition of special categories, the controller should put in place, by design and by default, suitable, robust and demonstrably effective organisational and technical measures to prevent the collection of special categories of personal data, or any other form of processing thereof, in the context of training, testing or validation data sets. The controller should take the appropriate measures during the entire lifecycle of an AI system or AI model and, without prejudice to the foregoing, where it identifies such data, should remove it swiftly and effectively, regardless of the effort or cost required, unless the controller can objectively and manifestly demonstrate that it is materially impossible to remove the data concerned, and not simply disproportionate or burdensome to do so. If the data cannot be deleted, the controller should take measures to prevent such data from being used to infer outputs, being disclosed or otherwise being made available to third parties, and should devise those measures in such a way as to enable the competent supervisory authority provided by Regulation (EU) 2016/679 to verify compliance therewith.
noyb's comment:
This proposed amendment does not go far beyond the Omnibus proposal. It allows the new limitation to the GDPR and only repeats existing requirements (mainly implementations of data minimization) as safeguards.
#327 Recital 35
Authored by
Text proposed by the Commission
(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. By contrast, it should be clarified in Article 12 of the Regulation that the right of access, which is from the outset favourable to data subjects, should not be abused in the sense that the data subjects abuse them for purposes other than the protection of their data. For example, such an abuse of the right of access would arise where the data subject intends to cause the controller to refuse an access request, in order to subsequently demand the payment of compensation, potentially under the threat of bringing a claim for damages. Other examples of abuse include situations where data subjects make excessive use of the right of access with the only intent of causing damage or harm to the controller or when an individual makes a request, but at the same time offers to withdraw it in return for some form of benefit from the controller. Moreover, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive conduct of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abuse only to a reasonable level. In any event, while requesting access under Article 15 of Regulation (EU) 2016/679 the data subject should be as specific as possible. Overly broad and undifferentiated requests should also be regarded as excessive.Amendment
(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. Given the large number of pending or unresolved access requests before controllers since the entry into force of Regulation (EU) 2016/679, data subjects should be deemed by default to be acting in their legitimate interest of defending their fundamental right to data protection. Burden of proof to the effect that a request is unfair, disproportionate or devoid of a legitimate purpose should always reside with the controller, who should justify their decision on the basis of objective, concrete and verifiable evidence.
#339 Recital 36
Authored by
Text proposed by the Commission
[...]Amendment
deleted
noyb's comment:
deletion of Commission's proposal regarding an additional exemption from the information requirement in Art 13.
#351 Recital 37
Authored by
Text proposed by the Commission
(37) Where the processing takes place for the purpose of scientific research and the provision of information to the data subject proves to be impossible or would involve a disproportionate effort it should not be necessary to provide the information provided for under Article 13 of this Regulation. The controller should make reasonable efforts to acquire contact details if they are readily available and acquisition would not require a disproportionate effort. The provision of the information would involve a disproportionate effort in particular where the controller at the time of collection of the personal data did not know or anticipate that it would process personal data for scientific research purposes at a later stage, in which case it may not have easily available contact details of the data subjects. In such situations the controller should inform data subjects indirectly, such as by making the information publicly available. The provision of such information should ensure that as many data subjects concerned as possible are reached. Relevant means to make the information publicly available should be determined depending on the context of the research project and the data subjects involved.Amendment
deleted
noyb's comment:
Pushing back against the extension of the exemption from information obligations in the case of processing for scientific purposes, is positive for the level of data protection since it requires data subjects to be informed about the processing of their data.
#373 Recital 38
Authored by
Text proposed by the Commission
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.Amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. It should be clarified that decisions based solely on automated processing are not allowed unless specific conditions are met, as set out in Regulation (EU) 2016/679. A decision based solely on automated processing should only be deemed necessary if no equally effective and less intrusive means are available to the data controller. Data subjects should retain the fundamental right not to have to be subjected to decisions of this kind and to be able to request that those decisions be made on the basis of significant human intervention. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing.
noyb's comment:
Slight pushback on the Commission's proposal and minor positive codification while taking over most of the Commission's proposal results in a privacy-neutral amendment.
#421 Recital 44 – paragraph 1
Authored by
Text proposed by the Commission
The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment and the subsequent processing of such data should be regulated under a single legal framework, namely Regulation (EU) 2016/679, where the subscriber of the electronic communications service or the user of the terminal equipment is a natural person. The amendments presented in this Regulation continue to offer the highest levels of protection for personal data, while simplifying the experiences of data subjects in exerting their rights and expressing their choices online. The amendments concern in particular storage of information in that equipment, accessing or otherwise collecting information from that equipment that entails the processing of personal data through cookies or similar technologies to gain information from the terminal equipment. The relevant rules should also apply regardless of whether the terminal equipment is owned by the natural person or by another legal or natural person.Amendment
deleted
#422 Recital 44 – paragraph 1
Authored by
Text proposed by the Commission
The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment and the subsequent processing of such data should be regulated under a single legal framework, namely Regulation (EU) 2016/679, where the subscriber of the electronic communications service or the user of the terminal equipment is a natural person. The amendments presented in this Regulation continue to offer the highest levels of protection for personal data, while simplifying the experiences of data subjects in exerting their rights and expressing their choices online. The amendments concern in particular storage of information in that equipment, accessing or otherwise collecting information from that equipment that entails the processing of personal data through cookies or similar technologies to gain information from the terminal equipment. The relevant rules should also apply regardless of whether the terminal equipment is owned by the natural person or by another legal or natural person.Amendment
deleted
#431 Recital 44 – paragraph 2
Authored by
Text proposed by the Commission
The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment should continue to be allowed only on the basis of consent. Similar to the approach in Directive 2002/58/EC, this requirement should not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, when that is based on Union or Member State law within the meaning of Article 6 of Regulation (EU) 2016/679 and if it fulfils all conditions of lawfulness laid down in that provision, and is done for the objectives laid down in Article 23(1) of Regulation (EU) 2016/679.Amendment
The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment should continue to be allowed only on the basis of consent. This requirement should not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, under certain conditions.
noyb's comment:
No legal certainty, plus supports the unworkable divide introduced by the Commission.
#436 Recital 44 – paragraph 3
Authored by
Text proposed by the Commission
With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. The controller, such as a media service provider, may mandate a processor, such as a market research company, to carry out the processing on its behalf.Amendment
deleted
noyb's comment:
Deletes amendment regarding more exceptions to tracking users.
#437 Recital 44 – paragraph 3
Authored by
Text proposed by the Commission
With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. The controller, such as a media service provider, may mandate a processor, such as a market research company, to carry out the processing on its behalf.Amendment
deleted
noyb's comment:
Deletes amendment regarding more exceptions to tracking users.
#444 Recital 44 – paragraph 4
Authored by
Text proposed by the Commission
For the subsequent processing of personal data for other purpose than those defined in the limitative list, Article 6 and, where relevant, Article 9 of Regulation (EU) 2016/679 should be applied. It is the responsibility of the controller in the light of the principle of accountability to choose the appropriate legal basis for the intended processing. In order to be able to rely on legitimate interest under Article 6(1), point f, of Regulation (EU) 2016/679 as a ground for the subsequent processing of personal data, the controller must show that it pursues the controller’s or third parties’ legitimate interest, the processing is necessary in order to achieve the purpose of that legitimate interest, and the interests or fundamental rights of the data subject do not override the interests pursued by the controller. In this context, controllers should take outmost account of the following elements: whether the data subject is a child; the reasonable expectations of data subject; the impact on the individual either because of the scale of data processed or the sensitivity of the data processed; the scale of the processing at issue in the sense that the processing cannot be particularly extensive either because of their amount or the range of categories of data; the processing should be based on data limited to what is necessary and cannot be based on monitoring of large parts of the online activity of the data subjects; and other relevant factors as appropriate. The processing should not give rise to the continuous monitoring of the data subject’s private life.Amendment
deleted
noyb's comment:
Pushes back on the Commission, but provides no significant improvement over the current legal situation.
#445 Recital 44 – paragraph 4
Authored by
Text proposed by the Commission
For the subsequent processing of personal data for other purpose than those defined in the limitative list, Article 6 and, where relevant, Article 9 of Regulation (EU) 2016/679 should be applied. It is the responsibility of the controller in the light of the principle of accountability to choose the appropriate legal basis for the intended processing. In order to be able to rely on legitimate interest under Article 6(1), point f, of Regulation (EU) 2016/679 as a ground for the subsequent processing of personal data, the controller must show that it pursues the controller’s or third parties’ legitimate interest, the processing is necessary in order to achieve the purpose of that legitimate interest, and the interests or fundamental rights of the data subject do not override the interests pursued by the controller. In this context, controllers should take outmost account of the following elements: whether the data subject is a child; the reasonable expectations of data subject; the impact on the individual either because of the scale of data processed or the sensitivity of the data processed; the scale of the processing at issue in the sense that the processing cannot be particularly extensive either because of their amount or the range of categories of data; the processing should be based on data limited to what is necessary and cannot be based on monitoring of large parts of the online activity of the data subjects; and other relevant factors as appropriate. The processing should not give rise to the continuous monitoring of the data subject’s private life.Amendment
deleted
noyb's comment:
Pushes back on the Commission, but provides no significant improvement over the current legal situation.
#452 Recital 44 – paragraph 5
Authored by
Text proposed by the Commission
Where the controller cannot rely on legitimate interest as a legal ground for the subsequent processing, the processing should be based on another ground in Article 6(1), in particular on consent in accordance with Articles 6 and 7 of Regulation (EU) 2016/679, provided that all principles of Regulation (EU) 2016/679 are met.Amendment
deleted
#454 Recital 44 – paragraph 5
Authored by
Text proposed by the Commission
Where the controller cannot rely on legitimate interest as a legal ground for the subsequent processing, the processing should be based on another ground in Article 6(1), in particular on consent in accordance with Articles 6 and 7 of Regulation (EU) 2016/679, provided that all principles of Regulation (EU) 2016/679 are met.Amendment
deleted
#463 Recital 46
Authored by
Text proposed by the Commission
(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser or in the EU Digital Identity Wallet as set out by Regulation (EU) 914/2014, or any other adequate means. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, media service providers should not be obliged to respect the machine-readable indications of data subject’s choices. The obligation for providers of web browsers to provide the technical means for data subjects to make choices with respect to the processing should not undermine the possibility for media service providers to request consent by data subjects.Amendment
deleted
noyb's comment:
Deleting the amendment for privacy signals, which could bring about significant improvements for users and simplify the interaction with users.
#481 Recital 47
Authored by
Text proposed by the Commission
(47) Directive 2002/58/EC on privacy and electronic communications ‘ePrivacy Directive’), last revised in 2009, provides a framework for the protection of the right to privacy, including the confidentiality of communications. It also specifies Regulation (EU) 2016/679 in relation to processing of personal data in the context of electronic communication services. It protects the privacy and the integrity of user’s or subscriber’s terminal equipment used for such communications. The current provision of Article 5(3) of Directive 2002/58/EC should remain applicable insofar as the subscriber or user is not a natural person, and the information stored or accessed does not constitute or lead to the processing of personal data.Amendment
(47) Directive 2002/58/EC on privacy and electronic communications ‘ePrivacy Directive’), last revised in 2009, provides a framework for the protection of the right to privacy, including the confidentiality of communications. It also specifies Regulation (EU) 2016/679 in relation to processing of personal data in the context of electronic communication services. It protects the privacy and the integrity of user’s or subscriber’s terminal equipment used for such communications.
noyb's comment:
Unclear if change means that the ePrivacy Directive remains applicable as it is or some other change is intended.
#484 Recital 47
Authored by
Text proposed by the Commission
(47) Directive 2002/58/EC on privacy and electronic communications ‘ePrivacy Directive’), last revised in 2009, provides a framework for the protection of the right to privacy, including the confidentiality of communications. It also specifies Regulation (EU) 2016/679 in relation to processing of personal data in the context of electronic communication services. It protects the privacy and the integrity of user’s or subscriber’s terminal equipment used for such communications. The current provision of Article 5(3) of Directive 2002/58/EC should remain applicable insofar as the subscriber or user is not a natural person, and the information stored or accessed does not constitute or lead to the processing of personal data.Amendment
(47) Directive 2002/58/EC on privacy and electronic communications ‘ePrivacy Directive’), last revised in 2009, provides a framework for the protection of the right to privacy, including the confidentiality of communications. It also specifies Regulation (EU) 2016/679 in relation to processing of personal data in the context of electronic communication services. It protects the privacy and the integrity of user’s or subscriber’s terminal equipment used for such communications. The current provision of Article 5(3) of Directive 2002/58/EC should remain applicable.
noyb's comment:
Relies on the current model instead that provides more legal security than the Commission proposal.
#934 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – second part
Text proposed by the Commission
‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#959 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38
Text proposed by the Commission
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.’Amendment
deleted
#997 Article 5 – paragraph 1 – point b (Article 3 – paragraph 1 – point 2)
Authored by
Regulation (EU) 2016/679
Article 5 – paragraph 1 – point b
Text proposed by the Commission
‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);’Amendment
‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the implementation of appropriate safeguards in accordance with Article 89(1), be considered to be compatible with the initial purposes of this Regulation, (‘purpose limitation’);’
noyb's comment:
The amendment reflects EDPB Guidelines 1/2026 and pushes back against the Commission's additional derogation to Article 6(4).
#1007 Article 7 – paragraph 4 (Article 3 – paragraph 1 – point 2 b (new))
Authored by
Regulation (EU) 2016/679
Article 7 – paragraph 4
Text proposed by the Commission
Amendment
2b. In Article 7, paragraph 4 is replaced by the following: '4. When assessing whether consent is freely given and personal data is processed fairly, utmost account shall be taken of whether, inter alia: (a) the controller has presented all options in a neutral and fair way without highlighting or otherwise prioritizing the option to consent; (b) the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract, is given or refused; or (c) the controller has employed designs, choice options, biased texts or other tactics with the aim of achieving consent, when this deviates from the genuine wishes of data subjects.'Justification
Clarifications to limit the use of dark patterns.
noyb's comment:
Clearer rules for deceptive designs and concepts like "fairness".
#1018 Article 9 – paragraph 2 – point k (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k
Text proposed by the Commission
(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently, as interpreted by EDPB Opinion 28/2024..
#1032 Article 8 – paragraph 2 – point l (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 8 – paragraph 2 – point l
Text proposed by the Commission
(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.’Amendment
(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the ‘one-to-one’ verification is under the sole control of the data subject, subject to appropriate safeguards to protect the fundamental rights and the interests of the data subject, and provided that the processing is in accordance with this Regulation and does not constitute a new derogation from the prohibition provided for in Article 9(1).’
noyb's comment:
The amendment supports the Commission's proposal of new derogation to Article 9(1) and at the same time provides that it is not a new derogation.
#1053 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 5
Text proposed by the Commission
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’Amendment
5. In the context of the development and operation of an AI system or an AI model, the personal data controller shall implement, by design and by default, robust, appropriate and demonstrably effective organisational and technical measures to avoid the collection and any other form of processing of special categories of personal data in the datasets used for training, testing or validation, and in the AI systems and models. Where, despite the application of those measures, special categories of personal data are discovered in those sets, systems or models, the controller shall have a primary and irrevocable obligation to remove them, irrespective of the effort or cost involved, unless the controller objectively demonstrates in documented form, and under its exclusive responsibility, that the removal is materially impossible and not merely disproportionate or burdensome. In that exceptional case, and only for as long as the material impossibility of removal persists, the controller shall adopt, without undue delay, all necessary and sufficient technical and organisational safeguards to ensure, in an effective and continuous manner, that such data are not used to produce outputs, disclosed, or in any way made available to third parties, and such safeguards shall be subject to periodic verification, audit and documentation in order to demonstrate compliance with this obligation to the competent supervisory authority.’
noyb's comment:
The proposed amendment mainly repeats the COM proposal, but adds wording ("burdensome removal", "only for as long as the [...] impossibility persists") that adds new defenses that would potentially violate current principles in Article 5 GDPR.
#1068 Article 12 – paragraph 2 (Article 3 – paragraph 1 – point 3 a (new))
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 2
Text proposed by the Commission
Amendment
3a. In Article 12, paragraph 2 is replaced by the following: 2. The controller shall facilitate the exercise of data subject rights under Articles 15 to 22 of this Regulation. The controller cannot require them to exercise their rights by particular means or limit their rights by offering restrictive online tools that do not allow to request all information under Article 15(1) to (3). In any case, the controller has to provide and publicly disclose an electronic-mail address which allows data subjects to send requests electronically. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject.Justification
It is up to data subjects how they exercise their rights under the GDPR. They are not bound by any form requirements. Similarly, the controller cannot require data subjects to use a particular form or medium to exercise their rights. This fact should be clarified while it should be required from controllers that they designate an email-address for data subjects who want to electronically exercise their rights. Controllers might also provide online-forms but they should still provide the alternative way of submitting an E-Mail.
noyb's comment:
Clarification on practices that are already unlawful under the GDPR.
#1078 Article 12 – paragraph 5 (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5
Text proposed by the Commission
Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either:Amendment
Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are deemed manifestly unfounded or excessive, in particular because of their repetitive character, the controller shall propose to the data subject the following scenarios:
noyb's comment:
With such deletion and small clarification, the regime stays the same as currently.
#1084 Article 12 – paragraph 5 – point a (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5 – point a
Text proposed by the Commission
(a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; orAmendment
(a) payment of a marginal fee not exceeding the administrative costs of providing the information or communication or taking the action requested; or
#1094 Article 12 – paragraph 5 – last subparagraph (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5 – last subparagraph
Text proposed by the Commission
The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.’Amendment
The data subject, when making the request, shall be presumed to be acting in the exercise of his or her legitimate interest in defending his or her rights under this Regulation. Any refusal on the grounds that the request is manifestly unfounded or excessive must be substantiated in writing, in a clear, specific and verifiable manner, indicating the objective facts and considerations supporting that conclusion. The justification must be sufficiently detailed to enable the data subject to understand the reasons for the refusal and to challenge it effectively, in particular by lodging a complaint with the supervisory authority or by seeking a judicial remedy. The burden of proof regarding whether the request is manifestly unfounded or excessive shall be on the controller.
noyb's comment:
The amendment contributes to enforceability and clarifies the justification expected when refusing to comply with an access request, however, the wording also (unintentionally?) limits the exercise of rights to the defence of rights under the GDPR, when access requests can be made to support other rights (e.g. worker's rights).
#1107 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 4
Text proposed by the Commission
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.’Amendment
4. Paragraphs 1, 2 and 3 shall not apply only where the controller can demonstrate that the data subject already has the respective information in his or her possession. At the time the data are collected, the controller shall make the information referred to in paragraphs 1, 2 and 3 permanently available to the data subject in an easily accessible form.’
noyb's comment:
Pushback against Commission's proposal and positive clarification.
#1121 Article 13 – paragraph 5 (Article 3 – paragraph 1 – point 6)
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 5
Text proposed by the Commission
5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.’Amendment
deleted
#1143 Article 22 – paragraph 1 (Article 3 – paragraph 1 – point 7)
Authored by
Regulation (EU) 2016/679
Article 22 – paragraph 1
Text proposed by the Commission
1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision:Amendment
1. The data subject shall have the right not to be subject to any decision based solely on automated processing, including profiling, that produces legal effects concerning them or that similarly significantly affects them, unless that decision:
#1148 Article 22 – paragraph 1 – point a (Article 3 – paragraph 1 – point 7)
Authored by
Regulation (EU) 2016/679
Article 22 – paragraph 1 – point a
Text proposed by the Commission
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means;Amendment
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller;
#1248 Article 41 a (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41 a
Text proposed by the Commission
10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’Amendment
deleted
noyb's comment:
With such deletion, the regime stays the same as currently.
#1359 Articles 88a, 88b, 88c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Articles 88a, 88b, 88c
Text proposed by the Commission
[...]Amendment
deleted