Angelika Niebler

Text proposed by the Commission

Amendment

(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given person or entity where that person or entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council. It should also be clarified that information, which is apparently impersonal, may still be considered personal data if the data subject can be identified with additional information obtained from another person or entity through means reasonably likely to be used making it possible to identify the data subject. In such circumstances, the fact that the information enabling the data subject to be identified is in the hands of other people does not prevent that data subject from being identifiable for the controller. The Court of Justice of the European Union has also held that information which are in themselves impersonal may become personal in nature where the controller puts them, or is likely to put them, at the disposal of other persons or entities who have means reasonably likely to enable the data subject to be identified. It is apparent, in particular, that if that information is put at these other persons or entities’ disposal – then this information is personal data for these persons and entities and, indirectly, for the controller. Accordingly, in so far as it cannot be ruled out that those persons or entities have means reasonably allowing them to attribute pseudonymised data to the data subject, such as cross-checking with other data at their disposal, the data subject must be regarded as identifiable as regards both that transfer and any subsequent processing of those data by those persons and entities. In such circumstances, pseudonymised data should be considered to be personal data. The Commission, together with the European Data Protection Board, may support controllers in the application of this updated definition by stipulating technical criteria in an implementing act.

noyb's comment:

The Parliament's amendment improves the Commission’s proposal that is meant to introduce a subjective approach to the definition of personal data. However, even with the new protections that this amednment seeks to afford, while it highlights an objective approach, it seems partly contradictory and does not go beyond the current understanding of the GDPR.

#291 Recital 32 a (new)

Authored by

Text proposed by the Commission

Amendment

(32a) The possibility of drawing conclusions regarding a data subject's health status through the combination, analysis or contextual interpretation of other data should not, in itself, result in the classification of such data as data concerning health for the purposes of Article 9. Data should only fall within the special category referred to in Article 9(1) where it directly and inherently discloses information concerning health, and not merely because such information could, in principle, be derived from it by a third party through further processing, enrichment or analysis.

noyb's comment:

The amendment restrains the scope of the definition in Article 9.

#310 Recital 33 a (new)

Authored by

Text proposed by the Commission

Amendment

(33a) To ensure legal certainty and support the responsible development and use of artificial intelligence in the Union, it should be clarified that processing of personal data in the context of development, deployment, training, testing, operation and improvement of AI systems or models, including related products and services, may constitute a lawful ground under this Regulation where the conditions laid down in Article 9(2), point (k), are met.

noyb's comment:

The amendment goes further than the Commission's proposal.

#347 Recital 36 a (new)

Authored by

Text proposed by the Commission

Amendment

(36a) To reduce administrative burdens for civil-society and volunteer-based organisations, associations and non-profit entities should not be subject to the full scope of the regulation and in particular not of information and record-keeping obligations of Regulation 2016/679, provided their data processing is limited to low-risk internal administrative purposes and does not involve systematic monitoring or high-risk operations. Member States should ensure that such entities can fulfil transparency obligations through general public information rather than individual notices

noyb's comment:

Reducing the scope for certain organisations simplifies GDPR compliance for those organisations while reducing the level of data protection. E.g. certain data subjects would not be informed about the processing of their data.

#435 Recital 44 – paragraph 2

Authored by

Text proposed by the Commission

The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment should continue to be allowed only on the basis of consent. Similar to the approach in Directive 2002/58/EC, this requirement should not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, when that is based on Union or Member State law within the meaning of Article 6 of Regulation (EU) 2016/679 and if it fulfils all conditions of lawfulness laid down in that provision, and is done for the objectives laid down in Article 23(1) of Regulation (EU) 2016/679.

Amendment

The storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment should continue to be allowed only on the basis of consent. Similar to the approach in Directive 2002/58/EC, this requirement should not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, when that is based on Union law within the meaning of Article 6 of Regulation (EU) 2016/679 and if it fulfils all conditions of lawfulness laid down in that provision, and is done for the objectives laid down in Article 23(1) of Regulation (EU) 2016/679.

noyb's comment:

Minimally improves the Commission proposal, but still relies on the devide between personal and non-personal cookies which brings about legal uncertainty.

Juan Ignacio Zoido Álvarez

#439 Recital 44 – paragraph 3

Authored by

Ana Miguel Pedro

Text proposed by the Commission

Amendment

With a view to reducing the compliance burden and providing legal clarity to controllers, and given that certain purposes of processing pose a low risk to the rights and freedoms of data subjects or that such processing may be necessary to provide a service requested by the data subject, it is necessary to define a limitative list of purposes for which the processing should be permitted without consent. This list should include measuring the audience of an online service by creating aggregated information about the usage of an online service, where it is carried out by the provider of that online service, or by a third party, such as a market research company or a Joint Industry Committee, acting together with or on behalf of this provider. ‘Audience measurement’ should be understood in accordance with Article 2(16) and with Article 24(1) of Regulation (EU) 2024/1083. Gatekeepers designated under Regulation (EU) 2022/1925 carrying out audience measurement may not rely on article 88a(3)c of this Regulation. As regards storing of personal data, or the gaining of access to personal data already stored, in a terminal equipment, and subsequent processing that is necessary for those purposes, this Regulation should therefore provide that the processing is lawful. The controller, such as a media service provider, may mandate a processor, such as a market research company, to carry out the processing on its behalf.

noyb's comment:

Relies on further exceptions to the current legal framework.

#943 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)

Authored by

Regulation (EU) 2016/679
Article 4 – point 1 – second part

Text proposed by the Commission

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

Amendment

Information relating to a natural person, is not personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. That assessment shall take into account objective factors, including but not limited to costs, time, available technology and the legal means available to that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

noyb's comment:

The amendment does not materially change the Commission's proposal, thus overall remains a decrease of protection compared to the current Article 4(1).

#948 Article 4 – point 15 (Article 3 – paragraph 1 – point 1 – point a)

Authored by

Regulation (EU) 2016/679
Article 4 – point 15

Text proposed by the Commission

Amendment

(15) ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status; Data that merely allow such information to be inferred indirectly shall not be considered data concerning health;

noyb's comment:

Lowering the protections for health data (e.g. person buying HIV medicine would not be covered anymore under Article 9 because the person could buy it for someone else).

#953 Article 4 – point 33 (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 33

Text proposed by the Commission

(33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply;

Amendment

(33) electronic communications networks’ means transmission systems as defined in of Article 2(1) of Directive (EU) 2018/1972;

#971 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 38

Text proposed by the Commission

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.

Amendment

(38) “scientific research” means creative and systematic work undertaken in order to increase the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts without any particular application or use in view, or through original investigation undertaken in order to acquire new knowledge directed primarily towards a specific, practical aim or objective. This does not exclude that the research may also aim to further a commercial interest.

noyb's comment:

like amendment 970

#1003 Article 5 – paragraph 3a (new) (Article 3 – paragraph 1 – point 2 a (new))

Authored by

Regulation (EU) 2026/679
Article 5 – paragraph 3a (new)

Text proposed by the Commission

Amendment

2a. In Article 5, the following paragraph 3 is added: '3a. The principles and obligations laid down in this Regulation shall be applied and interpreted in a manner that is commensurate with the objective pursued by the provision concerned, that restricts the free movement of personal data no further than is necessary, and that gives due weight to the interests and to the fundamental rights and freedoms of persons other than the data subject.'

noyb's comment:

The amendment includes a balancing test in favour of less privacy.

#1008 Article 6 – paragraph 4 – subparagraph (new) (Article 3 – paragraph 1 – point 2 b (new))

Authored by

Regulation (EU) 2016/679
Article 6 – paragraph 4 – subparagraph (new)

Text proposed by the Commission

Amendment

2b. In Article 6, paragraph 4, the following sentence is added: 'Where the intended further processing is compatible with the purposes for which the personal data were initially collected, it may rest on the legal basis that justified their collection; a separate legal basis shall not be required.'

noyb's comment:

Violates the need for a legal basis in Article 8(2) of the Charter. Consent for one purpose could be used for secondard processing for another purpose.

#1042 Article 9 – paragraph 2 – point la (new) (Article 3 – paragraph 1 – point 3 – point a)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 2 – point la (new)

Text proposed by the Commission

Amendment

(la) In Article 9, paragraph 2, the following point is inserted. the other points should be adapted accordingly. '(la) the processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of precontractual measures taken at the data subject’s request;'

noyb's comment:

The amendment includes more derogations than the Commission's proposal.

#1045 Article 9 – paragraph 1 (Article 3 – paragraph 1 – point 3 – point a a (new))

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 1

Text proposed by the Commission

Amendment

(aa) Paragraph 1 of Article 9 is replaced by the following: Processing of personal data that directly reveals in relation to a specific data subject racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health relating to the physical or mental health status of a natural person, or data concerning a natural person's sex life or sexual orientation shall be prohibited.

noyb's comment:

Limitation of scope of Article 9 to information that only "directly" reveals such data.

#1057 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 5

Text proposed by the Commission

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

Amendment

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented, in accordance with Article 89 safeguards to limit the processing of special categories of personal data and to mitigate the risk associated with the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall ensure that such data are processed under one or more of the conditions referred to in paragraph 2, points a to j, or remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’

noyb's comment:

The amendment proposes to have a "fall-back" Article 9(2) legal basis for residual special categories of personal data which is a wider allowance than initially proposed by the Commission.

#1061 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 5

Text proposed by the Commission

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

Amendment

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data that are incidentally and residually involved in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data without undue delay. If removal of those data requires manifestly disproportionate effort, the controller shall without undue delay and in any event, effectively protect such data from being further processed or processed for other purposes, used to produce outputs, being disclosed or otherwise made available to third parties.

noyb's comment:

Improvement versus COM proposal, but overall still more permissive than current GDPR.

#1098 Article 12 – paragraph 8a (new) (Article 3 – paragraph 1 – point 4 a (new))

Authored by

Regulation (EU) 2016/679
Article 12 – paragraph 8a (new)

Text proposed by the Commission

Amendment

4a. In Article 12, the following paragraph 8a is added: '8a. Where the controller is a SME, the obligations arising under this Chapter and the documentation duties connected with them shall apply in a manner proportionate to the size of the enterprise, the nature of the processing and the risk it presents for data subjects. The Board shall issue guidelines setting out simplified means of compliance for such enterprises.'

noyb's comment:

The amendment restricts all obligation under chapter 3 for SMEs (99% of all EU businesses), which could be beneficial for documentation duties but could restrict data subject rights. SMEs can include large data brokers and alike. The actual meaning of this provision is unclear, hence the simplification is unclear.

#1123 Article 13 – paragraph 5 (Article 3 – paragraph 1 – point 6)

Authored by

Regulation (EU) 2016/679
Article 13 – paragraph 5

Text proposed by the Commission

5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.

Amendment

5. When the processing takes place for scientific research purposes, including scientific research in the public interest aiming to further a commercial interest, and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort, including cases where the change of purpose could not have been anticipated at the time of collection, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available. This scenario shall apply equally to the obligations under Article 14(5)(b).

noyb's comment:

This proposal builds upon the Commission's proposal, but even decreases the level of privacy in those cases. It may violate the purpose limitation and fairness principle in Article 8(2) of the Charter.

#1128 Article 13 – paragraph 4a (new) (Article 3 – paragraph 1 – point 6 a (new))

Authored by

Regulation (EU) 2016/679
Article 13 – paragraph 4a (new)

Present text

Article 13 Information to be provided where personal data are collected from the data subject 1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: (a) the identity and the contact details of the controller and, where applicable, of the controller's representative; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; (e) the recipients or categories of recipients of the personal data, if any; (f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available. 2. In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability; (c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (d) the right to lodge a complaint with a supervisory authority; (e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; (f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. 3. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2. 4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.

Amendment

6a. In Article 13, paragraph 4a is added: "Paragraphs 1 to 4 shall not apply to associations, foundations, and other non-profit organisations established in the Union, provided that: (a) the processing of personal data is limited to the administration of membership, volunteers, donors, or beneficiaries; (b) such processing is not likely to result in a high risk to the rights and freedoms of natural persons; and (c) the data are not shared with third parties for commercial purposes."

Justification

Article 13 information obligations are essential for transparency, but they can create disproportionate administrative burdens for small non-profit organisations where the processing relationship is clear, direct and limited to internal administrative purposes. Associations, foundations and other non-profit organisations should therefore be allowed to fulfil transparency obligations through publicly accessible information where processing is limited to members, volunteers, donors or beneficiaries, does not involve systematic monitoring, is not likely to result in a high risk and is not used for commercial third-party sharing. This targeted clarification supports civic engagement and volunteer work while preserving the substance of the right to information.

noyb's comment:

This proposal adds an exemption from the information obligation similar to the Commission's proposal but limited in its scope. Unlike the Commission's proposal, this version is much clearer and the added legal uncertainty is probably lower than the administrative simplification. Such a broad ecemption of information duties likely violates the "fairness" principle in Article 8(2) of the Charter.

#1133 Article 15 – paragraph 3 (Article 3 – paragraph 1 – point 6 a (new))

Authored by

Regulation (EU) 2016/679
Article 15 – paragraph 3

Text proposed by the Commission

Amendment

6a. Article 15, paragraph 3 is amended as follows: 3. The controller shall provide the data subject with a copy of the personal data undergoing processing; that copy shall be confined to the personal data as such.

noyb's comment:

The amendment restricts the right to access.

#1137 Article 15 – paragraph 4 (Article 3 – paragraph 1 – point 6 b (new))

Authored by

Regulation (EU) 2016/679
Article 15 – paragraph 4

Text proposed by the Commission

Amendment

6b. Article 15, paragraph 4 is amended as follows: 4. The right of access referred to in paragraphs 1 and 2 and the right to obtain a copy referred to in paragraph 3 shall not affect the rights and freedoms of other persons, including the controller. Paragraph 3 shall not apply if and to the extent that the provision of the copy proves impossible or would require a disproportionate effort.

noyb's comment:

The amendment restricts the right to access and highlights a balancing test in favour of less privacy. Such a broad exemption likely violates the "access" element in Article 8(2) of the Charter.

#1192 Article 33 – paragraph 6 (Article 3 – paragraph 1 – point 8 – point c)

Authored by

Regulation (EU) 2016/679
Article 33 – paragraph 6

Text proposed by the Commission

6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

Amendment

6. The Board shall establish and make public common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person and a list of the circumstances in which it is not likely to result in such a high risk.. The template and lists shall be available to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2). 7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6.’

noyb's comment:

This amendment, in particular, follows some considerations of the EDPB/EDPS opinion and adds the creation of a white-list the documents the Board shall establish, providing increased legal certainty.

#1201 Article 34 – paragraph 2 (Article 3 – paragraph 1 – point 8 a (new))

Authored by

Regulation (EU) 2016/679
Article 34 – paragraph 2

Text proposed by the Commission

Amendment

8a. Article 34, paragraph 2 is amended as follows: 2. The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in points (b), (c) and (d) of Article 33(3) and, where possible, the categories of personal data records concerned.

noyb's comment:

This proposal adds the categories of personal data records concerned to the information required under Article 34(2), providing data subjects with more information. Since the controller already needs to have this information, the added administrative work in adding this information to the communication is insignificant.

#1209 Article 35 – paragraph 4 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 4

Text proposed by the Commission

4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

Amendment

4. The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

noyb's comment:

Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.

#1214 Article 35 – paragraph 5 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 5

Text proposed by the Commission

5. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.

Amendment

5. Processing operations not covered by the list in paragraph 4 shall not be subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

noyb's comment:

This template would reduce factually reduce the cases in which a controller would prepare a DPIA, resulting in a lower level of data protection but less administrative work for controllers.

#1217 Article 35 – paragraph 6 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 6

Text proposed by the Commission

6. The Board shall prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments.

Amendment

6. The Board shall establish a common template and a common methodology for conducting data protection impact assessments.

noyb's comment:

Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.

#1224 Article 35 – paragraph 6a (Article 3 – paragraph 1 – point 9 – point b)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 6a

Text proposed by the Commission

6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

Amendment

6a. The proposal for the list referred to in paragraph 4 and for the template and methodology referred to in paragraph within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2). That list shall be based on convergence area from national authorities and shall not introduce new categories of processing operations that go beyond existing obligations under this Regulation. Processing operations lawfully in place at the time of their initiation shall not be subject to a retroactive obligation to carry out a data protection impact assessment as a result of the adoption of the harmonised list.

noyb's comment:

This proposal (apparently subject to editorial mistakes) tries to narrow the scope of potential processing activities subject to a DPIA; therefore, it lowers the level of data protection. It also introduces some legal uncertainty, offsetting a potential reduction in administrative workload.

#1237 Article 37 – paragraph 7 (Article 3 – paragraph 1 – point 9 a (new))

Authored by

Regulation (EU) 2016/679
Article 37 – paragraph 7

Text proposed by the Commission

Amendment

9a. Article 37, paragraph 7, is amended as follows: The controller or the processor shall publish the contact details of the data protection officer.

noyb's comment:

This proposal gets rid of the controllers or processors obligation to communicate the contact details of the DPO to the supervisory authority. Therefore, this takes away the DPA’s option to check whether a DPO is appointed or draw up statistics like how many DPA’s are appointed in a single year. Similarly, in case of a complaint against a controller, the supervisory authority could see whether the controller has / had a DPO at the time of the violation. However, getting rid of the reporting obligation reduces complexity for controllers.

#1254 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 1

Text proposed by the Commission

(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.

Amendment

(1) The Commission may adopt implementing acts to specify technical and organisational measures and criteria supporting controllers in assessing whether data resulting from anonymisation or pseudonymisation no longer constitutes personal data for certain entities and in preventing the risk of re-identification.

noyb's comment:

The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1) and 4(6).

#1269 Article 41a – paragraph 2 – point a (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a

Text proposed by the Commission

(a) assess the state of the art of available techniques;

Amendment

(a) assess the state of the art of available techniques, such as privacy- enhancing technologies;

noyb's comment:

Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.

#1275 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b

Text proposed by the Commission

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.

Amendment

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data, taking into account objective factors such as cost, amount of time required, available technology, legal obligations.

noyb's comment:

#1281 Article 41a – paragraph 2 – point ba (new) (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 2 – point ba (new)

Text proposed by the Commission

Amendment

(ba) In Article 41a, paragraph 2, the following point ba is added: '(ba) assess technical, administrative, organisational and contractual measures that can prevent the risk of re-identification.'

noyb's comment:

Does not add anything material towards the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.

#1289 Article 41a – paragraph 3 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 3

Text proposed by the Commission

(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.

Amendment

(3) The implementation of the technical and organisational measures and criteria outlined in an implementing act may be used as an element to demonstrate that pseudonymised data do not lead to reidentification of the data subjects in a specific case.

noyb's comment:

#1312 Article 57 – paragraph 1 – point aa (new) (Article 3 – paragraph 1 – point 11 – point a a (new))

Authored by

Regulation (EU) 2016/679
Article 57 – paragraph 1 – point aa (new)

Text proposed by the Commission

Amendment

(aa) In Article 57, paragraph 1, the following point aa is inserted: '(aa) handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80 and investigate, in the case of a complaint by a data subject at its discretion, to the extent approriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisor authority is necessary;'

noyb's comment:

The amendment gives more discretion to supervisory authorities, which could lead to less complaint handling. The lack of a remedy (beyond civil courts) could violate Article 8(3) and 47 of the Charter.

#1314 Article 57 – paragraph 1 – va (Article 3 – paragraph 1 – point 11 – point a b (new))

Authored by

Regulation (EU) 2016/679
Article 57 – paragraph 1 – va

Text proposed by the Commission

Amendment

(ab) In Article 57, paragraph 1, the following point va is added: '(va) set up regulatory sandboxes to facilitate testing the compliance of specific techniques or technological solutions to be used for the data processing activities with the obligations under this Regulation or whether the data processing results in data that would be exempt from this Regulation.'

noyb's comment:

The amendment provides for compliance tools to be put in place by the supervisory authorities, ultimately shifting compliance to them. The fact that a full excemption from the Regulation is granted would undermine the rights under the GDPR.

#1326 Article 70 – paragraph 1 – point ha (Article 3 – paragraph 1 – point 14)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point ha

Text proposed by the Commission

Amendment

(ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment, pursuant to Article 35.

noyb's comment:

On its own, this amendment has no significant impact. Clear lists simplify the application of the law.

#1331 Article 70 – paragraph 1 – point hb (Article 3 – paragraph 1 – point 14)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hb

Text proposed by the Commission

(hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

Amendment

(hb) establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

noyb's comment:

This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.

#1336 Article 70 – paragraph 1 – point hc (Article 3 – paragraph 1 – point 14)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc

Text proposed by the Commission

(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

Amendment

(hc) establish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

noyb's comment:

This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.

#1370 Article 88a – paragraph 1 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 1

Text proposed by the Commission

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation.

Amendment

(1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject, and any subsequent processing necessary to achieve the purpose for which the data subject has given consent is only allowed when that person has given his or her consent, in accordance with this Regulation.

noyb's comment:

Unclear versus the current situation with the ePrivacy Directive given the confusing terminology, better than the Commission proposal.

Juan Ignacio Zoido Álvarez

#1379 Article 88a – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Ana Miguel Pedro

Regulation (EU) 2016/679
Article 88a – paragraph 2

Text proposed by the Commission

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).

Amendment

(2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1).

noyb's comment:

Linguistic change to aling with GDPR.

#1383 Article 88a – paragraph 3 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3

Text proposed by the Commission

(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:

Amendment

(3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following:

noyb's comment:

Minor changes to the Commission version.

#1387 Article 88a – paragraph 3 – point b (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point b

Text proposed by the Commission

(b) providing a service explicitly requested by the data subject;

Amendment

(b) providing a service or the maintenance of a user session explicitly requested by the data subject;

noyb's comment:

Broadens the exception and does not provide additional legal certainty, given that a user session can be used for many different purposes (from necessary elements to ads).

#1390 Article 88a – paragraph 3 – point c (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c

Text proposed by the Commission

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;

Amendment

(c) measuring the audience of an online service in order to draw aggregated information about the usage of an online service to measure the audience of such a service, as defined by article 2 (16) of Regulation 2024/1083, where it is carried out by the controller of that online service solely for its own use or by entitled third parties jointly authorised by advertisers and publishers, solely for the measurement of the overall market performance and subject to the safeguards laid down in Article 89(1);

noyb's comment:

Compared to the current legal framework, a new exception that relies on the Commission proposal, even if more limited that the Commission proposal.

#1393 Article 88a – paragraph 3 – point c (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c

Text proposed by the Commission

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;

Amendment

noyb's comment:

Broadens the new exception proposed. No need to aggregate/anonymize the data.

#1397 Article 88a – paragraph 3 – point ca (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point ca (new)

Text proposed by the Commission

Amendment

(ca) In Article 83, paragraph 3, the following point ca is inserted: '(ca) performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083.'

noyb's comment:

New exception to the rule. Also, wronlgy refers to Article 83 instead of 88.

#1398 Article 88a – paragraph 3 – point d (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point d

Text proposed by the Commission

(d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service.

Amendment

(d) maintaining or restoring the security, integrity and functioning of a service provided by the controller and requested by the data subject or the security of the terminal equipment used for the provision of such service, including detecting, preventing or mitigating fraud, automated or non-human traffic, unauthorised access, misuse of the service, circumvention of technical access conditions, or other uses that are contrary to the provider’s terms and conditions

noyb's comment:

Broadens the exception and makes the interpretation of the law subject to private terms and conditions, allowing to enforce them via accesst to other's PCs, smart phones or servers. Likely to go beyond any proportinality under Article 7 and 8 of the Charter.

#1406 Article 88a – paragraph 3 – point da (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)

Text proposed by the Commission

Amendment

(da) In Article 88a, paragraph 3, the following point da is added: '(da) legitimate purposes in relation to contextual advertising, including measuring the performance and reach of such advertisement or capping the frequency with which such advertisement is being displayed.'

noyb's comment:

New exception introduced.

#1410 Article 88a – paragraph 3 – point db (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point db

Text proposed by the Commission

Amendment

(db) In Article 88a, paragraph 3, the following point db is added: '(db) ‘legitimate interests’ according to Article 6(1)(f) of this regulation provided that the controller applies Privacy Enhancing Technologies (PETs) in accordance with the technical standards adopted pursuant to Article 25a. This point shall not apply to processing operations that involve tracking or profiling a data subject's behaviour for the purposes of behavioural advertising, regardless of whether there is a direct relationship with the data subject. This does not preclude the processing of data for internal product optimisation, provided such processing is not used to track the user.'

noyb's comment:

New exception introduced. Very vague, mixing different concepts (personal data, legitimate interest and PETs).

#1420 Article 88a – paragraph 4 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4

Text proposed by the Commission

(4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

Amendment

deleted

noyb's comment:

Removes clearer rules on the design of consent requests. Maintains more legal uncertainty.

#1424 Article 88a – paragraph 4 – introductory sentence (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4 – introductory sentence

Text proposed by the Commission

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply:

Amendment

Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject is based on consent, the following shall apply:

noyb's comment:

Minor change

#1426 Article 88a – paragraph 4 – point a (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4 – point a

Text proposed by the Commission

(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

Amendment

(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means, except where the controller is a media service provider as defined in Article 2 (2) of Regulation (EU) 2024/108

noyb's comment:

Waters down clearer rules for user options and makes the nature of consent absurd in cases of media service providers. Overall leads to a more complex landscape. Questionable from an equality before the law perspective.

#1437 Article 88a – paragraph 4 – point c (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c

Text proposed by the Commission

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.

Amendment

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months, except where the controller is a media service provider as defined in Article 2 (2) of Regulation (EU) 2024/108.

noyb's comment:

Limits the Commission proposal in case of media providers. Questionable from an equality before the law perspective.

#1441 Article 88a – paragraph 4a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4a (new)

Text proposed by the Commission

Amendment

(4a) In Article 88a, the following paragraph 4a is inserted: '4a. Nothing in this Article shall prevent a media service provider from making access to its service conditional on either the data subject's consent to the processing of personal data for one or more specified purposes, or the payment of a reasonable fee for access to an equivalent version that does not involve such processing. Where such is offered, both options shall be presented to the data subject with equal prominence, in plain language and without the use of dark patterns.'

noyb's comment:

Makes refusing consent dependent on a payment. Questionable from an equality before the law perspective.

#1444 Article 88b (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b

Text proposed by the Commission

Article 88b

Amendment

deleted

noyb's comment:

Undoes the positive Commission proposal.

#1453 Article 88b – title (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – title

Text proposed by the Commission

Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

Amendment

deleted

noyb's comment:

Undoes the positive Commission proposal.

#1455 Article 88b – title (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – title

Text proposed by the Commission

Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

Amendment

Voluntary automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

noyb's comment:

Significantly weakens the positive Commission proposal. A voluntary system would be chaotic and hardly functioning (see "DNT").

#1462 Article 88b – paragraph 1 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 1

Text proposed by the Commission

(1) Controllers shall ensure that their online interfaces allow data subjects to: (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.

Amendment

deleted

noyb's comment:

Undoes the positive Commission proposal.

#1468 Article 88b – paragraph 1 – point a (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a

Text proposed by the Commission

(a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;

Amendment

deleted

noyb's comment:

Removes the main aim of automated signals.

#1488 Article 88b – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 2

Text proposed by the Commission

(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.

Amendment

deleted

noyb's comment:

Makes automated signals voluntary.

#1499 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 3

Text proposed by the Commission

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.

Amendment

deleted

noyb's comment:

Broader application for automated signals, less interruptions for users, unique simpler experience for most interfaces. Exception is questionable from an equality before the law perspective.

#1505 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 3

Text proposed by the Commission

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.

Amendment

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service. This exemption extends to all processing carried out by or on behalf of a media service provider in connection with the provision of the media service.

noyb's comment:

Broadens the exception.

#1506 Article 88b – paragraph 3a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 3a (new)

Text proposed by the Commission

Amendment

(3a) In Article 88b, the following paragraph is inserted: '3a. Where a data subject gives specific consent to a controller pursuant to Article 88a, such consent shall prevail over any conflicting automated or machine-readable indication referred to in paragraph 1.'

noyb's comment:

Makes automated signals meaningless as common cookie banners would override them.

#1508 Article 88b – paragraph 4 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 4

Text proposed by the Commission

(4) The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.

Amendment

deleted

noyb's comment:

Removes the standardisation element.

#1513 Article 88b – paragraph 4 – first subparagraph (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph

Text proposed by the Commission

Amendment

The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. The European standardisation organisations shall, where appropriate, take into account existing international standards developed by international standardisation organisations, as well as emerging technical specifications developed by relevant industry consortia. When drawing up the standardisation mandate, the Commission shall consult the European Data Protection Board and an advisory forum comprising representatives of controllers, data subjects, media service providers, consumer protection organisations, academia and civil society to ensure that standards reflect diverse perspectives and do not create new gatekeepers

noyb's comment:

Positive approach, but should not only rely on specifications developed by industry consortia.

#1526 Article 88b – paragraph 5 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 5

Text proposed by the Commission

(5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].

Amendment

deleted

noyb's comment:

Can be read as good for privacy (shortening the time for application) or as negative as a part of deleting the article, given that an implementation in 20 days [when the Article would apply] seems too ambitious.

#1532 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 6

Text proposed by the Commission

(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.

Amendment

deleted

noyb's comment:

Limits the commission proposal.

#1536 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 6

Text proposed by the Commission

(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.

Amendment

(6) Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces that provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article ,and shall provide the technical means to allow media service providers to effectively use the exception pursuant to paragraph 3, as applied pursuant to paragraphs 2 to 5 of this article. The technical means should allow for granular choices, including category-based or purpose-based preferences, and shall enable data subjects to override global settings at the service level.

noyb's comment:

Removes the obligation for providing the technical options.

#1542 Article 88b – paragraph 7 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 7

Text proposed by the Commission

(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].

Amendment

deleted

noyb's comment:

#1549 Article 88b – paragraph 7a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 7a (new)

Text proposed by the Commission

Amendment

(7a) In Article 88b, the following paragraph is added: '7a. The Commission shall, by [insert date = 3 years after the date of entry into force of this Regulation], submit a report to the European Parliament and the Council on the functioning of this Article, including an assessment of: (a) the impact on user choice and competition; (b) the effectiveness of machine-readable indications in reducing consent fatigue; (c) the emergence of new gatekeeper risks; (d) the impact on European media service providers; and (e) the need for legislative amendment.'

noyb's comment:

Reporting duties of the Commission.

#1550 Article 88b – paragraph 7a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 7a (new)

Text proposed by the Commission

Amendment

(7a) In Article 88b, the following paragrpah is added: '7a. The Commission shall, by [insert date = 3 years after the date of entry into force of this Regulation], submit a report to the European Parliament and the Council on the functioning of this Article, including an assessment of: (a) the impact on user choice and competition; (b) the effectiveness of machine-readable indications in reducing consent fatigue; (c) the emergence of new gatekeeper risks; (d) the impact on European media service providers; and (e) the need for legislative amendment.'

noyb's comment:

Reporting duties of the Commission.

#1561 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 1

Text proposed by the Commission

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Amendment

Where the processing of personal data is necessary for the interests of the controller, or a third party, in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, including a general-purpose AI model as defined in Article 3, point (63) of Regulation (E) 2024/1689, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of this Regulation except where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child and except where other Union explicitly require consent. The processing of personal data in the context of the development and operation of an AI system may also be based for the performance of a task carried out by public authorities in the public interest pursuant to Article 6, paragraph 1, point (e) and paragraph 2.

noyb's comment:

The amendment rephrases the Commission's proposal.

#1562 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 1

Text proposed by the Commission

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Amendment

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of this Regulation, except where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child and where other Union laws explicitly require consent. The processing of personal data in the context of the development and operation of an AI system may also be based for the performance of a task carried out by public authorities in the public interest pursuant to Article 6, paragraph 1, point (e) and paragraph 2.

noyb's comment:

The amendment rephrases the Commission's proposal.

#1587 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 2

Text proposed by the Commission

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.

Amendment

Any such processing shall be subject to appropriate organisational, technical and legal measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects.

noyb's comment:

The amendment pushes against the right to object in proposed Article 88c.

#1589 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 2

Text proposed by the Commission

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.

Amendment

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with a right to object to the processing of their personal data.

noyb's comment:

The amendment pushes against an unconditional right to object.

#1596 Article 2 – paragraph 2 – point da (new) (Article 3 – paragraph 1 – subparagraph 1 (new))

Authored by

Regulation (EU) 2016/679
Article 2 – paragraph 2 – point da (new)

Text proposed by the Commission

Amendment

The following point (da) is added to Article 2(2): '(da) by a natural person in the course of an activity carried out entirely on a voluntary basis, unless that activity involves a type of processing listed pursuant to Article 35(4) GDPR.'

noyb's comment:

The change reduces data protection by narrowing the scope of the GDPR but facilitating complaince for voluntary activities. At the same time cooperation with controllers covered by the GDPR will likely be more complicated.

#1599 Article 14 – paragraph 5a (new) (Article 3 – paragraph 1 a (new))

Authored by

Regulation (EU) 2016/679
Article 14 – paragraph 5a (new)

Present text

Article 14 Information to be provided where personal data have not been obtained from the data subject 1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information: (a) the identity and the contact details of the controller and, where applicable, of the controller's representative; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) the categories of personal data concerned; (e) the recipients or categories of recipients of the personal data, if any; (f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available. 2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; (c) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability; (d) where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (e) the right to lodge a complaint with a supervisory authority; (f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources; (g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. The controller shall provide the information referred to in para graphs 1 and 2: (a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circum stances in which the personal data are processed; (b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or (c) if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed. 4. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2. 5. Paragraphs 1 to 4 shall not apply where and insofar as: (a) the data subject already has the information; (b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available; (c) obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject's legitimate interests; or (d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.

Amendment

In Article 14, paragraph 5a is added: "'5a. Where the controller is an association, foundation, or other non-profit organisation, and the personal data have not been obtained from the data subject, paragraphs 1 to 5 shall not apply where providing the information would require a disproportionate effort and the processing is limited to the internal purposes described in Article 13(6). In such cases, the controller shall adopt appropriate transparency measures.'"

Justification

Non-profit organisations may receive personal data indirectly in the context of volunteer coordination, beneficiary support, charitable activities or membership-related administration. In such situations, providing individual information notices to each data subject can require disproportionate effort, particularly for small or volunteer-based organisations. This amendment allows proportionate transparency measures, such as public notices or online publication, where the processing remains limited to low-risk internal purposes. It preserves transparency while avoiding unnecessary bureaucracy for civil-society organisations.

noyb's comment:

The amendment includes a derogation which is not foreseen in the current regime.

#1600 Article 30 – paragraph 5a (new) (Article 3 – paragraph 1 b (new))

Authored by

Regulation (EU) 2016/679
Article 30 – paragraph 5a (new)

Present text

Article 30 Records of processing activities 1. Each controller and, where applicable, the controller's represen tative, shall maintain a record of processing activities under its respon sibility. That record shall contain all of the following information: (a) the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer; (b) the purposes of the processing; (c) a description of the categories of data subjects and of the categories of personal data; (d) the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or inter national organisations; (e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the docu mentation of suitable safeguards; (f) where possible, the envisaged time limits for erasure of the different categories of data; (g) where possible, a general description of the technical and organisa tional security measures referred to in Article 32(1). 2. Each processor and, where applicable, the processor's representa tive shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing: (a) the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller's or the processor's represen tative, and the data protection officer; (b) the categories of processing carried out on behalf of each controller; (c) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the docu mentation of suitable safeguards; B (d) where possible, a general description of the technical and organisa tional security measures referred to in Article 32(1). 3. The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form. 4. The controller or the processor and, where applicable, the controller's or the processor's representative, shall make the record available to the supervisory authority on request. 5. The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.

Amendment

In Article 30, paragraph 5a is added "'5a. Paragraphs 1-4 shall not apply to associations, foundations, and other non-profit organisations whose processing activities are limited to the purposes described in Article 13(6).'"

Justification

Record-keeping obligations under Article 30 should be proportionate to the actual risk of the processing activity. Small non-profit organisations, associations and foundations often lack dedicated compliance structures and process data only for limited internal administrative purposes. Requiring full records of processing activities in such low-risk cases creates administrative burdens without a corresponding benefit for data subjects. This amendment clarifies that the exemption applies to non-profit organisations where processing is limited to the purposes set out in Article 13(6), while preserving the full obligation where processing is likely to result in a high risk to the rights and freedoms of data subjects.

noyb's comment:

While this amendment aims to add a new paragraph, it – apparently incorrectly – shows a deletion of the existing Article 30(1) GDPR. Not taking this into account, the reduction of the scope of Article 30 for certain organisations would – for them – reduce their administrative workload.

#1601 Article 2 – paragraph 2 – point e (new) (Article 3 – paragraph 1 c (new))

Authored by

Regulation (EU) 2016/679
Article 2 – paragraph 2 – point e (new)

Present text

2. This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity;

Amendment

In Article 2, the following point e is added: "'(e) by associations, foundations and other non-profit organisations established in the Union, where the processing is carried out solely in the course of their statutory non-commercial activities and is limited to the administration of members, former members, volunteers, donors or beneficiaries, provided that such processing does not involve systematic monitoring or processing likely to result in a high risk to the rights and freedoms of natural persons within the meaning of Article 35, and that the personal data are not disclosed to third parties for commercial purposes.'"

Justification

Associations, foundations and other non-profit organisations generally process personal data within clear, direct and non-commercial relationships with their members, volunteers, donors or beneficiaries. Subjecting such limited and low-risk processing to the full scope of Regulation (EU) 2016/679 places a disproportionate administrative burden on civil-society and volunteer-based organisations, many of which lack dedicated compliance structures. This targeted exclusion complements the specific simplifications proposed for Articles 13, 14 and 30, while preserving the application of the Regulation to systematic monitoring, automated decision-making, high-risk processing and the commercial disclosure of personal data.

noyb's comment:

The amendment reduces protection by limiting the scope of the GDPR but with that simplifying compliance for the affected controllers. At the same time cooperation with controllers covered by the GDPR will likely be more complicated.

#1602 Article 9 – paragraph 2 – point k (new) (Article 3 – paragraph 1 d (new))

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k (new)

Present text

2. Paragraph 1 shall not apply if one of the following applies: (a)the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject; (b)processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject; (c)processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; (d)processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;(e)processing relates to personal data which are manifestly made public by the data subject;(f)processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity; (g)processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; (h)processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3; (i)processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;

Amendment

In Article 9, paragraph 2 the following point k is added: "'(ja) processing is strictly necessary for the anonymisation of personal data pursuant to Article 6(3a), provided that the processing is subject to appropriate technical and organisational safeguards, that the data are not used to take measures or decisions concerning individual data subjects and that identifiable data are erased or rendered inaccessible as soon as they are no longer necessary for the anonymisation process.'"

#1603 Article 80 (Article 3 a (new))

Authored by

Regulation (EU) 2016/679
Article 80

Present text

Article 80 Representation of data subjects 1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.

Amendment

Article 3 a (new) Article 80 is deleted. ""

noyb's comment:

The amendment removes the right for data subjects to mandate a representative.

#1604 Article 6 – paragraph 3a (new) (Article 3 b (new))

Authored by

Regulation (EU) 2016/679
Article 6 – paragraph 3a (new)

Present text

3. The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:(a)Union law; or

Amendment

Article 3 b (new) In Article 6, the following paragraph 3a is inserted: "3a. Further processing of personal data for the sole purpose of anonymising those data shall be considered compatible with the purposes for which the personal data were initially collected and shall be lawful on the basis applicable to the initial processing."

noyb's comment:

This amendment allows controllers a derogation to anonymise data by claiming legitimate interest as a legal basis. This amendment can be beneficial for both controllers and data subjects.

#1605 Article 4 – point 5a (new) (Article 3 c (new))

Authored by

Regulation (EU) 2016/679
Article 4 – point 5a (new)

Present text

Article 4Definitions For the purposes of this Regulation: (1)‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; (2)‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; (3)‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future; (4)‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

Amendment

Article 3 c (new) In Article 4, the following point 5a is inserted "'(5a) “anonymisation” means the processing of personal data in such a manner that the resulting information does not or no longer constitute personal data for the controller or recipient concerned because the natural person to whom the information relates cannot be identified by means reasonably likely to be used by that controller or recipient, taking into account all objective factors and the means and criteria referred to in Article 41a;'"

noyb's comment:

(Full) anonymization can be good approahc. However, the Amendment now defines "relative" anonymization (conroller or a recipient). It also grants the power to determine the application of the GDPR to the Commission, which could violate Article 8(3) of the Charter.