Nadine Morano

Text proposed by the Commission

(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.

Amendment

(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means either allowing the unique identification of or confirming the identify of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification of his or her claimed identity, which rely on different technical processes. ‘Biometric identification’ means the automated recognition of a person’s physical, physiological, behavioural, or psychological features for the purpose of establishing his or her identity by comparing biometric data of that individual to that of other individuals recorded in a database. ‘Biometric verification’ means the automated, one-to-one verification, including authentication, of the identity of a natural person by comparing his or her biometric data to previously provided biometric data. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is carried out for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process. However, where justified by the operational and security requirements of strategic public transport infrastructure, the biometric data may be retained under the controller’s responsibility, provided that the controller guarantees a high level of personal data protection. Such processing should only be authorised if it is strictly necessary, proportionate to the aim pursued and carried out with respect for the rights and freedoms of the data subjects.

Text proposed by the Commission

(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. By contrast, it should be clarified in Article 12 of the Regulation that the right of access, which is from the outset favourable to data subjects, should not be abused in the sense that the data subjects abuse them for purposes other than the protection of their data. For example, such an abuse of the right of access would arise where the data subject intends to cause the controller to refuse an access request, in order to subsequently demand the payment of compensation, potentially under the threat of bringing a claim for damages. Other examples of abuse include situations where data subjects make excessive use of the right of access with the only intent of causing damage or harm to the controller or when an individual makes a request, but at the same time offers to withdraw it in return for some form of benefit from the controller. Moreover, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive conduct of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abuse only to a reasonable level. In any event, while requesting access under Article 15 of Regulation (EU) 2016/679 the data subject should be as specific as possible. Overly broad and undifferentiated requests should also be regarded as excessive.

Amendment

(35) Article 15 of Regulation (EU) 2016/679 provides data subjects with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and certain additional information. The right of access should allow the data subject to be aware of, and to verify, the lawfulness of the processing and enable him or her to exercise his or her other rights under Regulation (EU) 2016/679. By contrast, it should be clarified in Article 12 of the Regulation that the right of access, which is from the outset favourable to data subjects, should not be abused in the sense that the data subjects abuse them for purposes other than the protection of their data. For example, such an abuse of the right of access would arise where the data subject intends to cause the controller to refuse an access request, in order to subsequently demand the payment of compensation, potentially under the threat of bringing a claim for damages. Other examples of abuse include situations where data subjects make excessive use of the right of access with the only intent of causing damage or harm to the controller or when an individual makes a request, but at the same time offers to withdraw it in return for some form of benefit from the controller. Moreover, in order to keep their burden to a reasonable extent, controllers should bear a lower burden of proof regarding the excessive character of a request than regarding the manifestly unfounded character of a request. The reason is that the manifestly unfounded character of a request depends on facts that lie principally within the controller’s sphere of responsibility, whereas the excessive character of a request concerns the possibly abusive conduct of a data subject, which lies primarily outside the controller’s sphere of influence, and therefore the controller may be able to prove such abuse only to a reasonable level. In this regard, when exercising his or her right of access under Article 15 of Regulation (EU) 2016/679, the data subject must specify the precise scope of his or her request, as well as the specific justification for it, to allow the controller to assess whether it is reasonable. In any event, the data subject should be as specific as possible. Overly broad and undifferentiated requests should also be regarded as excessive.

Text proposed by the Commission

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’

Amendment

Information relating to a natural person does not necessarily constitute personal data for every person or entity, merely because another person or entity can identify that natural person. Whether or not information constitutes personal data should be assessed on a case-by-case basis, with regard to each person or entity that holds or receives that information, taking into account all means reasonably likely to be used by that person or entity to identify the natural person concerned, including the costs, time required and available technology. Information shall not be personal for a given person or entity where that person or entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used. Depending on the circumstances, pseudonymisation may prevent a person or entity other than the controller from identifying the data subject, such that, for that person or entity, the data subject is not, or is no longer, identifiable. That does not affect the classification of that information as personal data for the controller, nor its obligations under Articles 13 and 14.

Text proposed by the Commission

(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.

Amendment

(l) processing of biometric data is authorised when it is used to confirm the identity of a data subject (verification), provided that the biometric data or the means needed for that verification remain under the sole control of the data subject. Where biometric verification is part of an access control process within strategic public transport infrastructure, the storage of biometric data and the means necessary for verification may be under the exclusive control of the controller, provided that such processing is strictly necessary and proportionate, ensures a high level of security, including robust encryption, strict access controls and protection against cyberattacks, and fully respects the fundamental rights and freedoms of the data subjects concerned.

Text proposed by the Commission

The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.

Amendment

For the purpose of assessing whether a request is manifestly unfounded or excessive, the controller may ask the data subject to indicate the exact scope of the request and the specific reasons for the request.

Present text

4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

Amendment

5a. In Article 15, paragraph 4 is replaced by the following: ‘4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others, including the right to a fair trial, the right to privacy and confidentiality of communications, and the protection of trade secrets. In particular, that right cannot be interpreted as a general right of access to documents containing the data subject’s personal data, but shall relate only to the personal data concerning him or her. The controller may restrict or refuse a request to obtain a copy where it is likely to adversely affect the rights and freedoms of others, and where the assessment or implementation of the measures necessary to prevent such an adverse affect would impose a burden that is manifestly disproportionate to the volume, nature or complexity of the documents concerned. The right to obtain a copy shall not apply to requests for information or documents that are unrelated to the purposes of the processing carried out by the controller or that are made exclusively in the context of a dispute, a pre-litigation phase or court proceedings between the controller and the data subject.’

Present text

3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes his or her request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

Amendment

(Does not affect the English version.)

Text proposed by the Commission

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.

Amendment

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months unless a substantial change in circumstances, in the purposes of the processing or in the safeguards afforded to the data subject justifies a new request.

Text proposed by the Commission

Amendment

(ba) In Article 88b, paragraph 1, the following point ba is inserted: ‘(ba) modify, withdraw or reinstate their consent at any time, and modify their choice concerning the exercise of their right to object, by automated and machine-readable means, under conditions that are as straightforward as those for giving their consent or exercising that right.’