7 GDPR-relevant amendments by Alice Teodorescu Måwe
#946 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – second part
Text proposed by the Commission
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.Amendment
Regulation (EU) 2016/679 shall not apply to the processing of personal data, including sensitive personal data, where: (a) the processing is merely transitory in nature; and (b) the processing is for a purpose that is unrelated to the data subject as an identified or identifiable natural person; and (c) appropriate technical and/or organisational safeguards are in place to prevent any use of the data for a purpose related to the data subject as an identified or identifiable natural person up to the point when the data are irreversibly anonymised or erased.
noyb's comment:
The amendment includes more derogations than the Commission's proposal.
#947 Article 4 – point 1 – third part (new) (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – third part (new)
Text proposed by the Commission
Amendment
In Article 4, point 1, the following part is added: 'Data shall not be considered as personal data within the meaning of Regulation (EU) 2016/679 and other Union and national law referring to or relying on the notion of personal data within the meaning of Regulation (EU) 2016/679 insofar as: (a) the data relate primarily to an entity other than a natural person, such as an enterprise or an object, and the data subject is associated with that entity exclusively as owner, employee or in a similar function; and (b) processing of the data is for a purpose that is not specifically related to the data subject as an identified or identifiable natural person; and (c) appropriate technical and/or organisational safeguards are in place to prevent any use of the data for a purpose specifically related to the data subject as an identified or identifiable natural person.'
noyb's comment:
The amendment includes more derogations than the Commission's proposal.
#1092 Article 12 – paragraph 5 – last subparagraph (Article 3 – paragraph 1 – point 4)
Authored by
Regulation (EU) 2016/679
Article 12 – paragraph 5 – last subparagraph
Text proposed by the Commission
The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.Amendment
deleted
noyb's comment:
The amendment removes the burden of proof of controllers, it goes further than the Commission's proposal.
#1179 Article 33 – paragraph 1 (Article 3 – paragraph 1 – point 8 – point a)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 1
Text proposed by the Commission
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.Amendment
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the national entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56 of this Regulation. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.
#1252 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 1
Text proposed by the Commission
(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.Amendment
(1) The Commission may adopt implementing acts to specify means and criteria to determine when data (a) is merely transitory in nature; (b) is unrelated to the data subject as an identified or identifiable natural person; (c) has appropriate technical and/or organisational safeguards to prevent any use for a purpose related to the data subject as an identified or identifiable natural person.
noyb's comment:
While more privacy-oriented than the original Commission's proposal, the Parliament's amendment delegates powers to the Commission that form functions of the EDPB. The power to make such decisions lies with independet SAs under Article 8(3) of the Charter.
#1276 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
Text proposed by the Commission
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.Amendment
(b) develop criteria and or categories for controllers and recipients to assess the risk of data being used for a purpose related to the data subject as an identified or identifiable natural person
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1291 Article 41a – paragraph 3 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 3
Text proposed by the Commission
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.Amendment
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot be used for any purpose related to the data subjects as an identified or identifiable natural person.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.