5 GDPR-relevant amendments by Tomáš Kubín
#279 Recital 31
Text proposed by the Commission
(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, providing an unconditional right to object to the processing of their personal data, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.Amendment
(31) When the controller, in the light of the risk-based approach which informs the scalability of the obligations under this Regulation, is balancing the legitimate interest pursued by the controller or a third party and the interests, rights and freedoms of the data subject, consideration should be given to whether the interest pursued by the controller is beneficial for the data subject and society at large, which may for instance be the case where the processing of personal data is necessary for detecting and removing bias, thereby protecting data subjects from discrimination, or where the processing of personal data is aiming at ensuring accurate and safe outputs for a beneficial use, such as to improve accessibility to certain services. Consideration should also, among others, be given to reasonable expectations of the data subject based on their relationship with the controller, appropriate safeguards to minimise the impact on data subjects’ rights such as providing enhanced transparency to data subjects, ensuring that data subjects are informed of their right to object to the processing of their personal data in accordance with Article 21 of Regulation (EU) 2016/679, respecting technical indications embedded in a service limiting the use of data for AI development by third parties, the use of other state of the art privacy preserving techniques for AI training and appropriate technical measures to effectively minimise risks resulting, for example, from regurgitation, data leakage and other intended or foreseeable actions.Justification
Recital (31) as proposed by the Commission refers to "an unconditional right to object" as one of the appropriate safeguards. This reference is inconsistent with the right to object as comprehensively regulated by Article 21 of Regulation (EU) 2016/679, which provides for conditions and limitations to that right. This amendment brings it into alignment with the proposed amendment to Article 88c.
noyb's comment:
The proposed amendment suggesting to remove the unconditional character of the right to object to AI processing operations diminishes the data subjects' control over their personal data.
#307 Recital 33
Text proposed by the Commission
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI and taking into account the capabilities of the controller to identify and remove special categories of personal data, derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures in an effective manner to avoid the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, once it identifies such data, effectively remove them. If removal would require disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.Amendment
(33) The development of certain AI systems and AI models may involve the collection of large amounts of data, including personal data and special categories thereof. Special categories of personal data may residually exist in the training, testing or validation data sets or be retained in the AI system or the AI model, although the special categories of personal data are not necessary for the purpose of the processing. In order not to disproportionately hinder the development and operation of AI , derogating from the prohibition on processing special categories of personal data under Article 9(2) of Regulation (EU) 2016/679 should be allowed. The derogation should only apply where the controller has implemented appropriate technical and organisational measures to mitigate the risk of the processing of those data, takes the appropriate measures during the entire lifecycle of an AI system or AI model and, is notified of or itself identifies such data, implement technically and economically feasible measures to cease processing. If cessation of processing would require disproportionate effort, notably where the removal of special categories of data memorised in the AI system or AI model would require re-engineering the AI system or AI model, the controller should effectively protect such data from being used to infer outputs, being disclosed or otherwise made available to third parties. This derogation should not apply where the processing of special categories of personal data is necessary for the purpose of the processing. In this case, the controller should rely on the derogations pursuant to Article 9(2)(a) – (j) of Regulation (EU) 2016/679.Justification
This amendment ensures interpretive consistency between the recital and the operative provision and prevents supervisory authorities or courts from using the unchanged recital as a basis for a more restrictive interpretation of the derogation than that intended by the amended Article 9(5). It also reflects the extended scope of the controller's duty to act, which now covers situations in which the controller is notified of the presence of special categories of personal data by third parties, and not only cases of self-identification.
noyb's comment:
This amendment proposes that the controller only implements measures that are "economically feasible".
#1058 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)
Regulation (EU) 2016/679
Article 9 – paragraph 5
Text proposed by the Commission
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Amendment
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to mitigate the risk of the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller is notified of or identifies special categories of personal data relating to specific data subjects in the aforementioned datasets used for training, testing or validation or in the AI system or AI model, the controller shall implement technically and economically feasible measures to cease processing of those special categories of personal data for the purpose of training or developing an AI system or AI model. If cessation of processing requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Justification
The current wording of Article 9(5), requiring controllers to “avoid” the collection and processing of special categories of personal data, may be interpreted too broadly and create the expectation that controllers must eliminate such data entirely in advance. In practice, this is often not feasible, especially where large and diverse datasets are used for training and testing AI systems, and thus it could hinder AI development where appropriate safeguards are already in place. The amendment therefore replaces this overly rigid standard with a more proportionate obligation to mitigate the risk through appropriate technical and organisational measures. This approach is consistent with Article 25 - the principle of data protection by design and by default. At the same time, it preserves the duty to act where the controller is notified of, or identifies, the presence of such data - thereby covering situations in which the relevant data is brought to the controller's attention by third parties, and not only cases of self-identification. Where cessation of processing would require disproportionate effort, the controller shall implement technically and economically feasible measures to protect the data from being used to produce outputs or otherwise made available to third parties. This standard avoids imposing obligations that are impossible to fulfil in practice and is in line with the GDPR framework.
noyb's comment:
The amendment includes more derogations than the Commission's proposal.
#1568 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)
Regulation (EU) 2016/679
Article 88c – paragraph 1
Text proposed by the Commission
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Amendment
Where the processing of personal data is necessary for the interests of the controller or a third party in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Justification
Article 88c should remain fully coherent not to create new sources of legal fragmentation within the Union. While the Commission’s objective of simplification is well founded, the current wording of Article 88c does not fully achieve that aim.First, Article 6 GDPR expressly refers to the legitimate interests of both the controller and a third party. Limiting Article 88c to the interests of the controller alone would therefore introduce an unnecessary restriction and would reduce legal certainty for the development and operation of AI systems. Second, the reference to an “unconditional right to object” is not aligned with the GDPR framework. The right to object is already comprehensively governed by Article 21 GDPR, which establishes the applicable conditions and limitations. Introducing an unconditional variant within Article 88c would deviate from that framework, create inconsistencies in interpretation and enforcement, and effectively render the legitimate interests ground unavailable in practice for the purposes covered by this provision.
#1585 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)
Regulation (EU) 2016/679
Article 88c – paragraph 2
Text proposed by the Commission
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.Amendment
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of an AI system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with right to object to the processing of their personal data in accordance with Article 21 of Regulation (EU) 2016/679.Justification
Article 88c should remain fully coherent not to create new sources of legal fragmentation within the Union. While the Commission’s objective of simplification is well founded, the current wording of Article 88c does not fully achieve that aim.First, Article 6 GDPR expressly refers to the legitimate interests of both the controller and a third party. Limiting Article 88c to the interests of the controller alone would therefore introduce an unnecessary restriction and would reduce legal certainty for the development and operation of AI systems. Second, the reference to an “unconditional right to object” is not aligned with the GDPR framework. The right to object is already comprehensively governed by Article 21 GDPR, which establishes the applicable conditions and limitations. Introducing an unconditional variant within Article 88c would deviate from that framework, create inconsistencies in interpretation and enforcement, and effectively render the legitimate interests ground unavailable in practice for the purposes covered by this provision.
noyb's comment:
The amendment pushes against an unconditional right to object.