111 GDPR-relevant amendments by Axel Voss
#224 Recital 27 a (new)
Authored by
Text proposed by the Commission
Amendment
(27a) Regulation (EU) 2016/679 already has elements of a risk-based approach. However, especially small and medium enterprises cannot benefit from a risk-based approach if the necessary legal certainty is not provided through clear thresholds. To increase the legal certainty for more limited processing the objective categories for small, medium and large processers is introduced. Small controllers are all controllers that have or will process the data of less than [100.000] data subjects in the pending or preceding financial year, including short-term transactional processing. As a default the current rules in the Regulation are maintained and controllers are deemed a medium controller. A controller may only benefit from the privileges for small controllers if there is positive knowledge about fulfilling the criteria. Controllers like hospitals or Unions that by their very nature process large numbers of sensitive data under Article 9 or 10 of Regulation (EU) 2016/679 shall not be deemed a small controller. While small controllers must not comply with many administrative requirements of the Regulation, the rights of data subjects, which are largely based on Article 8(2) of the Charter are not altered. Given the existing burden of proof of controllers, the lack of formal documentation shall not limit the effective enforcement of data subjects’ rights. In the rare case of a complaint or procedure against a small controller, they may proof compliance with any formal or informal evidence according to national procedural law.Justification
RISK-BASED APPROACH #1: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
Clear thresholds would simplify the application of the law. Nevertheless, SMEs would have more limited obligations, which would typcially (indirectly) limit the rights of data subjects.
#229 Recital 27 b (new)
Authored by
Text proposed by the Commission
Amendment
(27b) At the same time the rules in Regulation (EU) 2016/679 have proven to be too lenient for very large controllers, such as data brokers or large platforms. Hence a category of large controllers is introduced to ensure more stringent rules of controllers with large processing operations. Large controllers shall for example be regularly inspected, face increased transparency and reporting obligations. Large controllers are defined by absolute or relative number of data subjects in any given Member State, to include dominant controllers in all Member States. A national list of such large controllers shall allow supervisory authorities and the public to have transparency about relevant controllers.Justification
RISK-BASED APPROACH #2: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
The recital has a potential of 1) working in the favor of fundamental rights of data subjects by designating VLOPs and giving them more reporting and transparency obligations; and 2) mandating closer cooperation between VLOPs and local authorities which can lead to better communication and expectation management between the two. How this is implemented in actuality is dependent on the wording in the law itself.
#231 Recital 27 c (new)
Authored by
Text proposed by the Commission
Amendment
(27c) Given the limited resource of supervisory authorities, large controllers shall be certified for compliance with Regulation (EU) 2016/679 each year. To ensure a high level of protection and to ensure that certification bodies that knowingly and repeatedly certified conduct that was clearly or foreseeably unlawful, new options for the revocation of accreditation are introduced.Justification
RISK-BASED APPROACH #3: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
Improved enforcement and simplification by introducing an enforcement system for very large controllers.
#291 Recital 32 a (new)
Authored by
Text proposed by the Commission
Amendment
(32a) The possibility of drawing conclusions regarding a data subject's health status through the combination, analysis or contextual interpretation of other data should not, in itself, result in the classification of such data as data concerning health for the purposes of Article 9. Data should only fall within the special category referred to in Article 9(1) where it directly and inherently discloses information concerning health, and not merely because such information could, in principle, be derived from it by a third party through further processing, enrichment or analysis.
noyb's comment:
The amendment restrains the scope of the definition in Article 9.
#310 Recital 33 a (new)
Authored by
Text proposed by the Commission
Amendment
(33a) To ensure legal certainty and support the responsible development and use of artificial intelligence in the Union, it should be clarified that processing of personal data in the context of development, deployment, training, testing, operation and improvement of AI systems or models, including related products and services, may constitute a lawful ground under this Regulation where the conditions laid down in Article 9(2), point (k), are met.
#320 Recital 34
Authored by
Text proposed by the Commission
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.Amendment
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. Derogating from the prohibition to process biometric data under Article 9(1) of Regulation (EU) 2016/679 should be allowed where data subject is offered a non-biometric alternative and suitable safeguards are implemented to ensure fundamental rights of the data subject are adequately protected through the implementation of the necessary safeguards. For example, this is the case, where the biometric data is securely stored by the device of the data subject, or the biometric data is securely stored by the controller in a encrypted form and the encryption key or equivalent means is securely held the data subject, and subject to measures ensuring the overall security of the processing, including during the enrolment phase of data subject and at the time when the data subject agrees to share the biometric data or encryption key. Other examples of appropriate safeguards are ensuring that end-to-end encryption, or similar state of the art technology, is used when data are transmitted over a communication channel and providing data subjects with the possibility to securely erase their biometric data in accordance with Article 17 of Regulation (EU) 2016/679.Justification
Biometric identification can enable trusted digital identity services, including the European Digital Identity Wallet, but requires clear safeguards. The amendment provides legal certainty for voluntary biometric use where a comparable non-biometric alternative is available and fundamental rights are protected. Secure local storage, encryption controlled by the data subject, secure enrolment and transmission, and erasure options ensure user control, privacy and security by design while supporting responsible European innovation.
noyb's comment:
The amendment almost goes back to a consent requirement, like under the current text, and includes an obligation to provide a less intrusive alternative.
#321 Recital 34
Authored by
Text proposed by the Commission
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.Amendment
(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should be allowed where the data subject is offered a non-biometric alternative and suitable safeguards are implemented to ensure fundamental rights of the data subject are adequately protected through the implementation of the necessary safeguards. For example, where the biometric data are securely stored solely by the device the side of the data subject, or the biometric data is are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, and subject to measures ensuring the overall security of the processing, including during the enrolment phase of data subject and at the time when the data subject agrees to share the biometric data or encryption key. Other examples of appropriate safeguards are ensuring that end-to-end encryption, or similar state of the art technology, is used when data are transmitted over a communication channel and providing data subjects with the possibility to securely erase their biometric data in accordance with Article 17 of Regulation (EU) 2016/679.
noyb's comment:
The amendment almost goes back to a consent requirement, like under the current text, and includes an obligation to provide a less intrusive alternative.
#374 Recital 38 a (new)
Authored by
Text proposed by the Commission
Amendment
(38a) To ensure compliance with the requirements of this Regulation in respect of the processing to be carried out by the processor on behalf of the controller, when entrusting a processor with processing activities, the controller should use only processors providing sufficient guarantees, in particular in terms of expert knowledge, reliability and resources, to implement technical and organisational measures which will meet the requirements of this Regulation, including for the security of processing. The adherence of the processor to an approved code of conduct or an approved certification mechanism may be used as an element to demonstrate compliance with the obligations of the controller. If processing by a processor is governed by an agreement with the controller which specifies the subject matter and duration of the processing, the nature and purpose of the processing, the types of data to be processed and the categories of data subjects the tasks and duties of the processor shall be directly qualified by this Regulation in order to avoid legal uncertainty and provide clear standards for all parties, which process personal data within the scope of European law. Furthermore, if the processor provides a binding assurance as to the level of protection to which it is able to ensure the security of the processing and its obligation to assist the controller by means of appropriate technical and organisational measures and confirms the suitability of these safeguards for the processing operations it intends to carry out, due to the nature of these services as mere digital infrastructure Services their agreements may renounce on some specific notification requirements of controllers. However, processors who fail to fulfil those assurances are directly liable for this non compliance. After the completion of the processing on behalf of the controller, the processor should, at the choice of the controller, return or delete the personal data, unless there is a requirement to store the personal data under Union or Member State law to which the processor is subject.Justification
Article 28 should better reflect modern cloud, hosting, security and infrastructure services, which are standardised, layered and technically complex. For such infrastructure processing, controllers need enforceable assurances on security, assistance and downstream liability, not bespoke descriptions of every technical sub-operation. The amendment cuts formalistic contract burdens while preserving core duties: confidentiality, security, assistance, deletion or return, audits, controller suitability checks and processor liability for sub-processors.
noyb's comment:
This proposal seems to be connected with the direct application of some of the contents of Article 28 for the processor without requiring those aspects to be part of the processing agreement. However, the third sentence is rather unclear when it comes to the “specific notification requirements” and how they are affected by the contract with the processor.
#467 Recital 46
Authored by
Text proposed by the Commission
(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser or in the EU Digital Identity Wallet as set out by Regulation (EU) 914/2014, or any other adequate means. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, media service providers should not be obliged to respect the machine-readable indications of data subject’s choices. The obligation for providers of web browsers to provide the technical means for data subjects to make choices with respect to the processing should not undermine the possibility for media service providers to request consent by data subjects.Amendment
(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser or in the EU Digital Identity Wallet as set out by Regulation (EU) 914/2014, or any other adequate means. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, media service providers should not be obliged to respect the machine-readable indications of data subject’s choices. The obligation for providers of web browsers to provide the technical means for data subjects to make choices with respect to the processing should not undermine the possibility for media service providers to request consent by data subjects. To support media sustainability in Europe, Media Service Providers can ask for consent or establish necessary conditions for other legal bases for third parties as long as that is done for data processing required to support the functioning or funding of Media Service Providers and is conducted exclusively on their properties.
noyb's comment:
Goes back beyond the Commission proposal. Tries to grant legislative powers to Media Service Providers?!
#489 Recital 48 a (new)
Authored by
Text proposed by the Commission
Amendment
(48a) The free movement of personal data within the Union and the protection of natural persons are objectives of equal rank of this Regulation. Where a provision of this Regulation is open to more than one interpretation in respect of processing privileged under Article 10a, preference is to be given to the interpretation that gives effect to both objectives. The privilege rests on an exchange: the controller or processor obtains a presumption of compliance and relief from documentation duties, and in return makes data available for objectives of general interest; that exchange establishes, in the assessment under Article 52(1) of the Charter, the proportionality of the privilege as a whole. The extent of the data to be made available should be proportionate to the nature and scale of the processing and to the size and capacity of the controller or processor. Standards applied in the market, including international standards, may afford safeguards equivalent to those of approved codes of conduct and certification mechanisms; the Board should include a standard in its list where compliance with the standard is independently verifiable and monitored and where its safeguards afford an equivalent level of protection, and should remove it where those conditions cease to be met. The ordinary commercial activities of a micro, small or medium-sized enterprise do not include the making available of personal data against remuneration as its principal activity. Article 10a provides a basis in Union law for the purposes of points (g) and (j) of Article 9(2); whether the processing is necessary remains to be assessed in the individual case, and the essence of the right to data protection is to be respected in every application of the Article. Specific and substantiated indications require concrete elements relating to the processing in question; the assertion of an infringement does not suffice, and full proof is not required. Standardised information fulfils the purpose of Articles 13 and 14 where it enables data subjects to identify the controller, understand the purposes of the processing and exercise their rights. For transfers to third countries, the presumption leaves intact the requirement that data subjects enjoy a level of protection essentially equivalent to that guaranteed within the Union. The rights of data subjects do not depend on the commitment; its withdrawal ends the privilege for the future and leaves obligations already incurred unaffected. The powers of supervisory authorities and the rights and remedies of data subjects shall remain unaffected.Justification
This amendment creates an incentive model for data use serving general-interest objectives, such as intra-group administration, SME operations, research, archiving and statistics. Privileged status is limited to actors that make a data-sharing commitment and follow recognised safeguards, including codes, certification, BCRs or listed standards. The rebuttable presumption rewards accountable governance without lowering protection, excludes gatekeepers and VLOPs/VLOSEs, and covers high-risk processing only after a DPIA.
noyb's comment:
Privileging processing for certain commercial purposes while presuming their compliance reduces the level of data protection. The assumed compliance and the reduced documentation duties might provide for less complexity for some controllers.
#923 Article 2 – paragraph 4a (Article 3 – paragraph -1 (new))
Authored by
Regulation (EU) 2016/679
Article 2 – paragraph 4a
Present text
No equivalentAmendment
-1 Article 2 is amended by adding the following paragraph: "4a. Articles [19, 20, 27, 30, 35 to 39] of this Regulation do not apply to small controllers."Justification
RISK-BASED APPROACH #4: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
The reducing of scope of the GDPR reduces complaince obligations for small controllers, but protection for data subjects.
#924 Article 2 – paragraph 2 (Article 3 – paragraph -1 a (new))
Authored by
Regulation (EU) 2016/679
Article 2 – paragraph 2
Present text
2. This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity; (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public securityAmendment
-1 a In Article 2, four new points are added to paragraph 2: "2. This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity; (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; (da) by natural or legal persons for non-professional or non-commercial purposes; (db) in the course of an activity that is likely to result in a low risk to the rights and freedoms of natural persons; (dc) by micro, small and medium-sized enterprises; (dd) which is of a purely incidental or transitory nature and is carried out for a purpose unrelated to the data subject as an identified or identifiable natural person."Justification
SCOPE EXCLUSION #1: This amendment offers an alternative to the proposed risk-based simplification package by excluding non-commercial, low-risk, SME and purely incidental processing from the GDPR’s full scope. It does not deregulate such processing: Member States must ensure protection through other suitable laws, including private-life, contract, consumer, labour, tort, unfair-competition and criminal law. This reduces disproportionate administrative burdens, supports data flows and focuses GDPR enforcement on processing that creates real risks for individuals.
noyb's comment:
The amendment significantly reduces the scope of the application of the GDPR and thus reducing compliance burdens, but at the same time significantly reduces protections of data subjects.
#926 Article 2 – paragraph 4 (new) (Article 3 – paragraph 1 – point -1 (new))
Authored by
Regulation (EU) 2016/679
Article 2 – paragraph 4 (new)
Present text
No equivalentAmendment
– In Article 2, a new paragraph is added after paragraph 4: "4a. Member States shall ensure that the processing of personal data that is exempted from the scope of this Regulation pursuant to paragraphs […] is subject to the obligations of other laws than data protection law, including legislation on the protection of private and family life, contract law, tort law, unfair competition law, consumer law, labor law and criminal law. These other laws shall meet objectives of general interest, especially the free flow of data, and, subject to the principle of proportionality, strike a fair balance between all persons involved in or affected by the data processing."Justification
SCOPE EXCLUSION #2: This amendment offers an alternative to the proposed risk-based simplification package by excluding non-commercial, low-risk, SME and purely incidental processing from the GDPR’s full scope. It does not deregulate such processing: Member States must ensure protection through other suitable laws, including private-life, contract, consumer, labour, tort, unfair-competition and criminal law. This reduces disproportionate administrative burdens, supports data flows and focuses GDPR enforcement on processing that creates real risks for individuals.
noyb's comment:
This change would reduce protection of data subjecs because of excluding certain processing from the GDPR while at the same time signficantly increasing legal uncertainty and inconsistency by requiring that data protection will be inserted into other EU law.
#943 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 1 – second part
Text proposed by the Commission
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.Amendment
Information relating to a natural person, is not personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. That assessment shall take into account objective factors, including but not limited to costs, time, available technology and the legal means available to that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.
noyb's comment:
The amendment does not materially change the Commission's proposal, thus overall remains a decrease of protection compared to the current Article 4(1).
#948 Article 4 – point 15 (Article 3 – paragraph 1 – point 1 – point a)
Authored by
Regulation (EU) 2016/679
Article 4 – point 15
Text proposed by the Commission
Amendment
(15) ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status; Data that merely allow such information to be inferred indirectly shall not be considered data concerning health;
noyb's comment:
Lowering the protections for health data (e.g. person buying HIV medicine would not be covered anymore under Article 9 because the person could buy it for someone else).
#953 Article 4 – point 33 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 33
Text proposed by the Commission
(33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply;Amendment
(33) electronic communications networks’ means transmission systems as defined in of Article 2(1) of Directive (EU) 2018/1972;
#971 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38
Text proposed by the Commission
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.Amendment
(38) “scientific research” means creative and systematic work undertaken in order to increase the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts without any particular application or use in view, or through original investigation undertaken in order to acquire new knowledge directed primarily towards a specific, practical aim or objective. This does not exclude that the research may also aim to further a commercial interest.
#975 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38
Text proposed by the Commission
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.Amendment
(38) “scientific research” means any research activity including technological development demonstration, fundamental research, applied research and privately funded research. These actions shall contribute to existing scientific knowledge, apply to existing knowledge in novel ways, or be carried out with the aim of contributing to the growth of society´s general knowledge or wellbeing. This does not exclude that the research may also aim to further a commercial interest.Justification
Scientific research should be defined by its purpose, methodology and contribution to knowledge, not by whether it is carried out by academia, public bodies or companies. The amendment codifies the broad approach already reflected in GDPR Recital 159, covering technological development, demonstration, fundamental, applied and privately funded research. Commercial interest alone should not exclude genuine research from the GDPR research framework or Article 89 safeguards.
#976 Article 4 – point 38a (new) (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38a (new)
Text proposed by the Commission
Amendment
(38a) ‘small controller’ means any controller, if: (a) the processing of personal data is not a core business activity of the controller, (b) does not process special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10 as part of another core business activity of the controller, a department or branch of the controller and (c) the controller processes personal data of less than [100 000] data subjects in the pending or preceding financial year.Justification
RISK-BASED APPROACH #5: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
#981 Article 4 – point 38b (new) (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38b (new)
Text proposed by the Commission
Amendment
(38b) ‘large controller’ means a controller, if: (a) it processed personal data of more than [50 000 000] or more than [33]% of the population of any given Member State in the pending or preceding financial year, or (b) if it was designated a gatekeeper under Article 3 of Regulation (EU) 2022/1925 or a very large online platform or very large online search engine under Article 33 of Regulation (EU) 2022/2065.Justification
RISK-BASED APPROACH #6: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
#987 Article 4 – point 38c (new) (Article 3 – paragraph 1 – point 1 – point b)
Authored by
Regulation (EU) 2016/679
Article 4 – point 38c (new)
Text proposed by the Commission
Amendment
(38c) ‘medium controller’ means any controller that is not a small controller or large controller.Justification
RISK-BASED APPROACH #7: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
#1001 Article 5 – paragraph 2a (new) (Article 3 – paragraph 1 – point 2 a (new))
Authored by
Regulation (EU) 2016/679
Article 5 – paragraph 2a (new)
Present text
No equivalentAmendment
2a. In Article 5, the following paragraph is added: "2a. The principles of this Regulation relating to the protection of personal data shall be interpreted in such a way that the requirements of this Regulation are proportionate to the purpose for which they are intended and, in particular, take into account the varying likelihood and severity of the risk that data processing poses to the rights and freedoms of natural persons (risk-based approach). Measures taken to protect personal data must strike a fair balance with the interests or fundamental rights and freedoms of persons other than the data subject."Justification
INNOVATION PACKAGE #1: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
The amendment includes a proportionality test for the core GDPR principles, a balancing test which could go further than Article 52 of the Charter and general risk-based approach which takes into account the likelihood of a risk. It leads to a generalized decrease of protection.
#1009 Article 5 – paragraph 2 (Article 3 – paragraph 1 – point 2 b (new))
Authored by
Regulation (EU) 2016/679
Article 5 – paragraph 2
Present text
2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).Amendment
2b. In Article 5, paragraph 2 is amended: "2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). When assessing compliance with the accountability obligation, appropriate governance structures, in particular, the appointment of a data protection officer in accordance with Article 37, shall be taken into account."Justification
DPO Package #1: The amendment strengthens accountability by recognising DPOs as practical governance safeguards and first points of contact for complaints. DPOs already advise controllers and processors, monitor compliance and support data subjects; giving them an explicit complaint-handling role makes resolution faster, less bureaucratic and closer to the facts. Voluntary or shared DPOs are encouraged. Supervisory authorities remain available where the complaint is not addressed or not fully remedied within one month.
noyb's comment:
Seems to support voluntary DPO appointments. Unclear how this would link to the duties in Article 5(2).
#1012 Article 6 – paragraph 1 – point f –subparagraph (Article 3 – paragraph 1 – point 2 c (new))
Authored by
Regulation (EU) 2016/679
Article 6 – paragraph 1 – point f –subparagraph
Present text
No equivalentAmendment
2c. Article 6, paragraph 1, point f, including the second subparagraph, is amended as follows: "(fa) processing is necessary for the anonymisation of personal data and that processing serves the principles of data minimisation or storage limitation. (2nd sub-paragaph) For the purposes of point f, controllers that are part of a group of undertakings within the meaning of Article 4, point 19, or institutions affiliated to a central body, shall be presumed to have a legitimate interest in transmitting personal data within that group or between such affiliated institutions for clearly defined internal administrative purposes, including central human resources management, financial and accounting administration, compliance monitoring, IT and cybersecurity management, internal audit, risk management and group reporting, provided that the processing is necessary and proportionate for those purposes and subject to appropriate technical and organisational safeguards. This presumption shall not affect the rights and freedoms of the data subject, including the right to object under Article 21, the processing of special categories of personal data under Article 9, the processing of personal data relating to criminal convictions and offences under Article 10, or the rules on transfers of personal data to third countries or international organisations under Chapter V. An illustrative list of legitimate interests within the meaning of point f of the first subparagraph is included in Annex II; the Commission is empowered to adopt delegated acts to amend Annex II by adding, deleting or modifying use-cases of legitimate interests, after having consulted the Board referred to in Article 68. Point f of the first subparagraph shall not apply to processing carried out by public authorities where they act in performance of sovereign powers."Justification
The package makes Article 6 more predictable by clarifying that anonymisation may require a lawful processing step, recognising safeguarded intra-group administrative transfers, and adding a non-exhaustive Annex of legitimate-interest use cases. This supports consistent application across the Union without creating a blanket permission: necessity, proportionality and the balancing test remain required, especially for children. Commission updates after EDPB consultation keep the framework adaptable to new technologies and business practices. (see ANNEX 1a)
noyb's comment:
The amendment includes a derogation in relation to Article 6(1)(f) which is not foreseen in the current regime.
#1014 Article 5 – paragraph 1– point c (Article 3 – paragraph 1 – point 2 d (new))
Authored by
Regulation (EU) 2016/679
Article 5 – paragraph 1– point c
Present text
1. Personal data shall be:Amendment
2d. Article 5, paragraph 1, point c is deleted: "1. Personal data shall be:"
#1027 Article 9 – paragraph 2 – point k (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k
Text proposed by the Commission
(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.Amendment
(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or a GPAI model, subject to the conditions referred to in paragraph 5.Justification
The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.
#1036 Article 9 – paragraph 2 – point l (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point l
Text proposed by the Commission
(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.Amendment
(l) processing of biometric data for the purposes of uniquely identifying a natural person provided that the use of biometric data is not mandatory, that a non-biometric alternative of comparable effectiveness is available to the data subject and that appropriate safeguards are applied to protect the fundamental rights and interests of the data subject.Justification
The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.
noyb's comment:
The amendment improves the Commission's proposal to a point where data subjects are almost as protected as in the current regime.
#1039 Article 9 – paragraph 2 – point la (new) (Article 3 – paragraph 1 – point 3 – point a)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point la (new)
Text proposed by the Commission
Amendment
(la) processing is necessary for the development, testing, validation, deployment or improvement of technologies directly or indirectly serving an important public-benefit purpose, provided that: (i) the processing does not pursue a direct identification of data subjects and a direct allocation of special categories of personal data to an individual person; (ii) the controller does not take decisions producing legal effects or similarly significant effects concerning identified natural persons on the basis of such processing; (iii) the processing is limited to what is necessary for the relevant public-benefit purpose; and (iv) appropriate technical and organisational safeguards are applied, including data minimisation, access restrictions and, where feasible, pseudonymisation or anonymisation.Justification
The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.
noyb's comment:
The amendment includes massive additional derogations than the Commission's proposal. Uncelar wording does not seem to simplify matters.
#1045 Article 9 – paragraph 1 (Article 3 – paragraph 1 – point 3 – point a a (new))
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 1
Text proposed by the Commission
Amendment
(aa) Paragraph 1 of Article 9 is replaced by the following: Processing of personal data that directly reveals in relation to a specific data subject racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health relating to the physical or mental health status of a natural person, or data concerning a natural person's sex life or sexual orientation shall be prohibited.
noyb's comment:
Limitation of scope of Article 9 to information that only "directly" reveals such data.
#1056 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 5
Text proposed by the Commission
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Amendment
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data.Justification
The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.
noyb's comment:
This amendment goes further than the COM proposal in providing a bigger allowance than the proposed Article 9(5).
#1057 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 5
Text proposed by the Commission
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Amendment
5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented, in accordance with Article 89 safeguards to limit the processing of special categories of personal data and to mitigate the risk associated with the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall ensure that such data are processed under one or more of the conditions referred to in paragraph 2, points a to j, or remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’
noyb's comment:
The amendment proposes to have a "fall-back" Article 9(2) legal basis for residual special categories of personal data which is a wider allowance than initially proposed by the Commission.
#1070 Article 9 – paragraph 1 (Article 3 – paragraph 1 – point 3 a (new))
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 1
Present text
1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.Amendment
3a. In Article 9, paragraph 1 is replaced by the following: "1. Processing of personal data that is intended to directly reveal, in relation to an identified or identifiable natural person, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health status, sex life or sexual orientation, and the processing of genetic data or biometric data for the purpose of uniquely identifying a natural person, shall be prohibited unless one of the conditions set out in paragraph 2 applies. The mere possibility that one of the characteristics referred to in the first subparagraph may be inferred indirectly from personal data processed for another lawful purpose shall not, in itself, render such processing subject to this Article, provided that the controller does not process the data for the purpose of revealing such characteristic."Justification
The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.
noyb's comment:
This proposal intends to limit the essence of the right to the protection of personal data, specifically for special categories of personal data by limiting their protection to only "directly" identified/identifiable persons.
#1072 Article 9 – paragraph 2a (new) (Article 3 – paragraph 1 – point 3 b (new))
Authored by
Regulation (EU) 2016/679
Article 9 – paragraph 2a (new)
Present text
No equivalentAmendment
3b. In Article 9, the following paragraphs are added: "2a. For the purposes of paragraph 2, point (la), important public-benefit purposes shall include in particular: (a) the protection of life, health and physical integrity; (b) road safety, accident prevention and transport safety; (c) prevention of criminal offenses; (d) anti-discrimination and foster inclusion and participation of all persons on an equal basis; (e) cybersecurity, including the resilience of connected products, transport and traffic systems and critical infrastructure; (f) scientific research and technological development contributing to the purposes referred to in points (a) to (e). 2b. Processing pursuant to paragraph 2, point (la), shall not be used for the purpose of identifying natural persons, monitoring individual behaviour for unrelated purposes, or taking decisions concerning identified natural persons, unless another legal basis under this Regulation applies."Justification
The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.
noyb's comment:
The amendment is not clear in its scope, and the way it fits into existing Article 9 GDPR. A limitation on the use of sensitive personal data should first comply with Article 52 Charter.
#1073 Article 10a (new) (Article 3 – paragraph 1 – point 3 c (new))
Authored by
Regulation (EU) 2016/679
Article 10a (new)
Present text
No equivalentAmendment
3c. After Article 10, a new Article is added: "Article 10a Privileged processing of personal data 1. The following processing serves objectives of general interest recognised by the Union and may be privileged in accordance with this Article ('privileged processing'): (a) processing necessary for internal administrative purposes within a group of undertakings, including the processing of personal data of clients and employees; (b) processing by a micro, small or medium-sized enterprise within the meaning of the Annex to Recommendation 2003/361/EC, necessary for its ordinary commercial activities; (c) processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), whether or not it constitutes further processing within the meaning of point (b) of Article 5(1). 2. Processing referred to in paragraph 1 shall be privileged where the controller or processor: (a) has committed, by entry in the register referred to in [the Data Act/ Data Governance Act], to making data available for objectives of general interest; and (b) carries out the processing in demonstrable conformity with an approved code of conduct pursuant to Article 40, an approved certification mechanism pursuant to Article 42, binding corporate rules approved pursuant to Article 47, or a standard included in the list established by the Board pursuant to Article 70 point (o). 3. Privileged processing pursues legitimate interests within the meaning of point (f) of Article 6(1). Where it concerns special categories of personal data and is necessary for the objectives referred to in paragraph 1, this Article constitutes a substantial public interest of Article 9(2)(g), (j). Privileged processing shall be presumed to comply with the requirements of this Regulation to which the safeguards give effect, including point (f) of Article 6(1), points (g) (j) of Article 9(2) and, where the controller or processor has assessed and documented that the law and practice of the third country do not impair the effectiveness of the safeguards, Article 46(1). The presumption shall be rebutted by specific and substantiated indications of non-compliance; in that event, the controller or processor shall demonstrate compliance in accordance with Article 5(2). 4. The obligations under Articles 13 and 14 may be fulfilled by providing the standardised information laid down in the instrument referred to in point (b) of paragraph 2. 5. Data made available under the commitment shall not be provided to undertakings referred to in point (b) of paragraph 6. The commitment may be withdrawn with effect for the future; upon withdrawal, the processing ceases to be privileged. The Commission shall adopt delegated acts in accordance with Article 92 specifying the categories of data to be made available, the conditions and modalities of making them available, and the safeguards for the protection of personal data and trade secrets. 6. This Article shall not apply to: (a) processing likely to result in a high risk within the meaning of Article 35, unless a data protection impact assessment has been carried out and its results have been implemented; (b) processing by an undertaking designated pursuant to Article 3 of Regulation (EU) 2022/1925 or Article 33(4) of Regulation (EU) 2022/2065, or by an undertaking belonging to the same group of undertakings."Justification
This amendment creates an incentive model for data use serving general-interest objectives, such as intra-group administration, SME operations, research, archiving and statistics. Privileged status is limited to actors that make a data-sharing commitment and follow recognised safeguards, including codes, certification, BCRs or listed standards. The rebuttable presumption rewards accountable governance without lowering protection, excludes gatekeepers and VLOPs/VLOSEs, and covers high-risk processing only after a DPIA.
noyb's comment:
This amendment proposes a limitation to the protection of both personal data and sensitive personal data by introducing a new legal basis which does not simplify the obligations of SME's.
#1112 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)
Authored by
Regulation (EU) 2026/679
Article 13 – paragraph 4
Text proposed by the Commission
4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.Amendment
4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information or where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.’
noyb's comment:
Small amendments to the Commission's proposal. Mainly clarififying that the proposal provides for an additional exemption. A lack of information typcially violates the "fairness" principle in Article 8(2) of the Charter.
#1115 Article 13 – paragraph 1 – points fa (new) and fb (new) (Article 3 – paragraph 1 – point 5 a (new))
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 1 – points fa (new) and fb (new)
Present text
No equivalentAmendment
5a. In Article 13, paragraph 1, the following points are added: "(fa) if the controller is a small, medium or large controller under Article 4(27) to (29) and; (fb) if the controller is a large controller, the number of data subjects they processed personal data about, the number of times data subjects have exercised their rights against them under Articles 13 to 22 and the number of each type of outcome, the number of data breaches under Article 32 and the number of likely affected data subjects, the number of procedures filed against them under Article 78 and 79, the certifications received or revoked under Article 42 and the name and contact details of the certification body that has certified them for the past three financial years."Justification
RISK-BASED APPROACH #8: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
This proposal adds additional information obligations regarding the controller’s size and even more information in case the controller is large. It is a package to limit obligations on SMEs and add requirements only for large controllers. Overall simplification.
#1123 Article 13 – paragraph 5 (Article 3 – paragraph 1 – point 6)
Authored by
Regulation (EU) 2016/679
Article 13 – paragraph 5
Text proposed by the Commission
5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.Amendment
5. When the processing takes place for scientific research purposes, including scientific research in the public interest aiming to further a commercial interest, and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort, including cases where the change of purpose could not have been anticipated at the time of collection, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available. This scenario shall apply equally to the obligations under Article 14(5)(b).
noyb's comment:
This proposal builds upon the Commission's proposal, but even decreases the level of privacy in those cases. It may violate the purpose limitation and fairness principle in Article 8(2) of the Charter.
#1130 Article 14 – paragraph 1 – points fa and fb (new) (Article 3 – paragraph 1 – point 6 a (new))
Authored by
Regulation (EU) 2016/679
Article 14 – paragraph 1 – points fa and fb (new)
Present text
No equivalentAmendment
6a. In Article 14(1), the following points are added: "(fa) if the controller is a small, medium or large controller under Article 4(27) to (29), and; (fb) if the controller is a large controller, the number of data subjects they processed personal data about, the number of times data subjects have exercised their rights against them under Articles 13 to 22 and the number of each type of outcome, the number of data breaches under Article 32 and the number of likely affected data subjects, the number of procedure filed against them under Article 78 and 79, the certifications received or revoked under Article 42 and the name and contact details of the certification body that has certified them for the past three financial years."Justification
RISK-BASED APPROACH #9: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
Additional information and a package bringind simplification to SMEs while adding duties to larger controllers.
#1164 Article 31 – paragraph 1a (new) (Article 3 – paragraph 1 – point 7 a (new))
Authored by
Regulation (EU) 2016/679
Article 31 – paragraph 1a (new)
Present text
No equivalentAmendment
7a. In Article 31, the following paragraph is added: "1a. Large controllers shall report all information complied under Article 13(1f2) and 14(1f2) and the certification under Article 42, as well as any other information the supervisory authority may specify, to the supervisory authority at their main establishment or the main establishment of their representative under Article 27. The information shall be provided no later than one month after the end for their financial year in a machine-readable format specified by the supervisory authority. The supervisory authorities shall compile and keep up to date a public national list of all large controllers, including their address, contact details, number of data subjects processed in the last three financial years, the certification body that most recently certified them, number of procedures under Article 77 and 79 and a link to the information published under Article 13 and 14."Justification
RISK-BASED APPROACH #10: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
Introducing additional reporting obligations for large controller will increase the level of privacy since it is much easier for supervisory authorities to detect non-compliance. Similarly, large controller will take into account their duty to provide this information to the supervisory authority when drafting the documents. On the other hand, introducing additional reporting obligations will make it more complex to comply and will therefore not result in a simplification. Part of a package that will (overall) lead to simplification.
#1170 Article 25 – paragraphs 3a, 3b (new) (Article 3 – paragraph 1 – point 7 b (new))
Authored by
Regulation (EU) 2016/679
Article 25 – paragraphs 3a, 3b (new)
Present text
No equivalentAmendment
7b. In Article 25, the following paragraphs are added: "3a. Where personal data processing under paragraph 2 is carried out exclusively by means of Privacy-Enhancing Technologies certified pursuant to paragraph 4, the data controller shall benefit from a rebuttable presumption of compliance with the data minimisation principle under Article 5(1)(c) of Regulation (EU) 2016/679 in respect of that processing. All other obligations under Regulation (EU) 2016/679 shall continue to apply. 3b. The Commission shall be empowered to adopt delegated acts recognising Privacy-Enhancing Technologies (PETs) and establishing the technical standards and criteria for Privacy-Enhancing Technologies eligible for certification under paragraph 3, following the governance model established in Article 41a of Regulation (EU) 2016/679. Those delegated acts shall be adopted in accordance with the examination procedure and following consultation with relevant authorities as appropriate. Standards shall include benchmarks to prevent misuse of PET certification for data practices that do not genuinely meet minimum privacy thresholds."Justification
Certified PETs make data protection by design operational. Technologies such as differential privacy, homomorphic encryption, synthetic data and robust pseudonymisation reduce identifiability and support data minimisation while enabling data-driven innovation and AI. A rebuttable presumption under Article 5(1)(c) creates a real incentive to deploy certified PETs without exempting controllers from other GDPR duties. Commission-set, technology-neutral standards and benchmarks prevent PET-washing and support interoperable European privacy infrastructure.
noyb's comment:
Although PETs are at all times welcome and can indeed help in achieving an entity's obligations under the GDPR (such as compliance with Article 25), due to the rapidly evolving nature of digital technologies, codifying specific tools (PETs) can prove useless. The European Commission is welcome to provide Guidelines and recommendations on PETs, however, this should be of periodical nature, rather than codified in the GDPR itself.
#1173 Article 25 – paragraph 2a (new) (Article 3 – paragraph 1 – point 7 c (new))
Authored by
Regulation (EU) 2016/679
Article 25 – paragraph 2a (new)
Present text
No equivalentAmendment
7c. In Article 25, the following paragraph 2a is added: "2a. In the case of processing carried out in the course of providing information society services which are likely to be accessed by children, when assessing what are appropriate technical and organisational measures in accordance with paragraph 1, the controller must take into account the children’s higher protection matters. The children’s higher protection matters are: (a) how children can best be protected and supported when using the services, and; (b) the fact that children: (i) merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing; and (ii) have different needs at different ages and at different stages of development. This paragraph is not to be read as implying anything about the matters that may be relevant to the assessment of what are appropriate technical and organisational measures for the purposes of paragraph 1 and 2 in cases other than those described in this paragraph. In this paragraph “information society services” does not include preventive or counselling services."Justification
The amendment makes children’s higher protection needs a concrete part of data protection by design for information society services likely to be accessed by children. Controllers must consider how children can best be protected and supported, including their lower awareness of risks and their different needs at different ages and development stages. This creates clearer duties without a one-size-fits-all model, preserves other Article 25 assessments and excludes preventive or counselling services.
noyb's comment:
Although this amendment is a step in the direction of promoting data protection, it is lacking substance with regards to how an entity should take the provided requirements into account, what are the specific requirements, and how should the analysis and implementation of the requirements be documented by the relevant entities in order to prove their compliance to Article 25(2a).
#1174 Article 28 (Article 3 – paragraph 1 – point 7 d (new))
Authored by
Regulation (EU) 2016/679
Article 28
Present text
1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. 2. The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. 3. Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: (a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; (b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; (c) takes all measures required pursuant to Article 32; (d) respects the conditions referred to in paragraphs 2 and 4 for engaging another processor; (e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III; (f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor; (g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data; (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions. 4. Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to thecontroller for the performance of that other processor's obligations. 5. Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as referred to in paragraphs 1 and 4 of this Article. 6. Without prejudice to an individual contract between the controller and the processor, the contract or the other legal act referred to in paragraphs 3 and 4 of this Article may be based, in whole or in part, on standard contractual clauses referred to in paragraphs 7 and 8 of this Article, including when they are part of a certification granted to the controller or processor pursuant to Articles 42 and 43. 7. The Commission may lay down standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the examination procedure referred to in Article 93(2). 8. A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the consistency mechanism referred to in Article 63.Amendment
7d. Article 28 is amended as follows: "1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. 2. Where the processor engages further processors, the processor shall always inform the controller of any intended change relating to the engagement or replacement of other processors, thereby giving the controller the opportunity to object to such changes. 3. Where the processing of personal data takes place under an agreement with the controller which specifies the subject matter and duration of the processing, the nature and purpose of the processing, the types of data to be processed and the categories of data subjects (processing on behalf of the controller), the processor may process the personal data only for the purposes of carrying out the contract or in accordance with other documented instructions from the controller — including in relation to the transfer of personal data to a third country or an international organisation — unless the processor is obliged to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of those legal requirements prior to processing, unless the law in question prohibits such notification on grounds of an important public interest. The data processor shall ensure: (a) that persons authorised to process personal data have undertaken to maintain confidentiality or are subject to an appropriate statutory duty of confidentiality; (b) that all measures necessary for the performance of the contract, as set out in Article 32, are taken; (c) that the conditions set out in paragraphs 2 and 4 regarding the use of the services of a further processor are complied with; The processor shall assist the controller in: (a) fulfilling the controller’s obligations to respond to requests for the exercise of the data subject’s rights referred to in Chapter III, where possible by taking appropriate technical and organisational measures, taking into account the nature of the processing; (b) to comply with the controller’s obligations set out in Articles 32 to 36, taking into account the nature of the processing and the information available to the controller. The processor is obliged: (a) upon completion of the processing operations, to either erase or return all personal data, at the choice of the controller, unless there is an obligation under Union law or the law of the Member States to retain the personal data; (b) to provide the controller with all necessary information to demonstrate compliance with the obligations laid down in this Article, and to allow for and cooperate with audits – including inspections – carried out by the controller or another auditor mandated by the controller. With regard to paragraph 4(b), the processor shall inform the controller without delay if it considers that an instruction infringes this Regulation or other data protection provisions of the Union or the Member States. 4. Where the processor engages the services of another processor to carry out specific processing activities on behalf of the controller, the following shall apply to that other processor: (a) the obligations set out in paragraph 3 shall apply mutatis mutandis or, where this Regulation does not apply to that processor pursuant to Articles 2 and 3, (b) by means of a contract or other legal instrument under Union law or the law of the Member State concerned, the same data protection obligations as those laid down between the controller and the processor in accordance with paragraph 3, whereby, in particular, sufficient safeguards must be provided to ensure that the appropriate technical and organisational measures are implemented so that the processing is carried out in accordance with the requirements of this Regulation. If the sub-processor fails to fulfil its data protection obligations, the first processor shall be liable to the controller for the fulfilment of the obligations of that sub-processor . 5. Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as referred to in paragraphs 1 and 4 of this Article. Paragraph 6, 7, and 8 are deleted. 9. The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form. 10. Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing. 10a. Notwithstanding paragraph 3, the agreement between the controller and the processor need not specify the nature and purpose of the processing, the types of data to be processed and the categories of data subjects, as required by the first sentence of paragraph 3, if (a) the processor provides a binding assurance as to the level of protection to which it is able to ensure the security of the processing and its obligation to assist the controller in accordance with the third sentence by means of appropriate technical and organisational measures; and (b) the controller confirms the suitability of these safeguards for the processing operations it intends to carry out (infrastructure processing). Paragraph 2 shall not apply in the context of infrastructure data processing insofar as: (a) data transfers to further processors are envisaged on the basis of Article 45 or safeguards pursuant to Article 46(2)(b), (e) and (f), and enforceable rights and effective remedies are available to data subjects; and (b) the first processor undertakes to the controller and the data subjects to assume liability for compliance with the obligations of the subsequent processors."Justification
Article 28 should better reflect modern cloud, hosting, security and infrastructure services, which are standardised, layered and technically complex. For such infrastructure processing, controllers need enforceable assurances on security, assistance and downstream liability, not bespoke descriptions of every technical sub-operation. The amendment cuts formalistic contract burdens while preserving core duties: confidentiality, security, assistance, deletion or return, audits, controller suitability checks and processor liability for sub-processors.
noyb's comment:
The amendment introduces new derogations in relation to Article 28 which is not foreseen in the current regime.
#1175 Article 28 (Article 3 – paragraph 1 – point 7 e (new))
Authored by
Regulation (EU) 2016/679
Article 28
Present text
Article 28 GDPR Processor 1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. 2. The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. 3. Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: (a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; (b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; (c) takes all measures required pursuant to Article 32; (d) respects the conditions referred to in paragraphs 2 and 4 for engaging another processor; (e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III; (f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor; (g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data; (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions. 4. Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. 2Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor’s obligations. 5. Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as referred to in paragraphs 1 and 4 of this Article. 6. Without prejudice to an individual contract between the controller and the processor, the contract or the other legal act referred to in paragraphs 3 and 4 of this Article may be based, in whole or in part, on standard contractual clauses referred to in paragraphs 7 and 8 of this Article, including when they are part of a certification granted to the controller or processor pursuant to Articles 42 and 43. 7. The Commission may lay down standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the examination procedure referred to in Article 93(2). 8. A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the consistency mechanism referred to in Article 63. 9. The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form. 10. Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing.Amendment
7e. Article 28 is replaced by the following: "Article 28 GDPR Processor 1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. 2. The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. 3. Any processor shall: (a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; (b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; (c) takes all measures required pursuant to Article 32; (d) respects the conditions referred to in paragraphs 2 and 4 for engaging another processor; (e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III; (f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor; (g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data; (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions. 3a. A controller may from a contract or other legal act under Union or Member State law, that is binding on the processor and that sets out further details, like the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. Such contracts shall not contain terms that are unfair or limit the rights and role of the controllers under this Regulation. 3b. A contractual term shall be regarded as unfair and void if it requires undue extra payment for the exercise of rights of the controller, limits the rights of the controller to enforce the contract or otherwise legally, factually or economically interferes with the rights of controllers under this Regulation. The European Commission may specify further terms of a contract that are regarded as unfair in accordance with the examination procedure referred to in Article 93(2). 4. Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in paragraph 3 to 3b shall apply or, if this Regulation does not apply to them directly, be imposed on that other processor by way of a contract or other legal act under Union or Member State law and at least the jurisdiction of a Member State, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor’s obligations. 5. Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as referred to in paragraphs 1 and 4 of this Article. 6. Without prejudice to an individual contract between the controller and the processor, the contract or the other legal act referred to in paragraphs 3 and 4 of this Article may be based, in whole or in part, on standard contractual clauses referred to in paragraphs 7 and 8 of this Article, including when they are part of a certification granted to the controller or processor pursuant to Articles 42 and 43. 7. The Commission may lay down standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the examination procedure referred to in Article 93(2). 8. A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the consistency mechanism referred to in Article 63. 9. The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form. 10. Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing."Justification
Alternative to other Art 28 proposal. Attempts also to shift burdens from SMEs to large processors, hyperscalers and software producers. This change would make the duties directly applicable to processors, removing the need for millions of B2B contracts.
noyb's comment:
This is a step in the correct direction as paragraph 3 codifies the requirements of Article 28(3) without requiring a contract. Overall, it strengthens the position of controllers.
#1192 Article 33 – paragraph 6 (Article 3 – paragraph 1 – point 8 – point c)
Authored by
Regulation (EU) 2016/679
Article 33 – paragraph 6
Text proposed by the Commission
6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).Amendment
6. The Board shall establish and make public common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person and a list of the circumstances in which it is not likely to result in such a high risk.. The template and lists shall be available to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2). 7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6.’
noyb's comment:
This amendment, in particular, follows some considerations of the EDPB/EDPS opinion and adds the creation of a white-list the documents the Board shall establish, providing increased legal certainty.
#1209 Article 35 – paragraph 4 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 4
Text proposed by the Commission
4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.Amendment
4. The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.
noyb's comment:
Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.
#1214 Article 35 – paragraph 5 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 5
Text proposed by the Commission
5. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.Amendment
5. Processing operations not covered by the list in paragraph 4 shall not be subject to the requirement for a data protection impact assessment pursuant to paragraph 1.
noyb's comment:
This template would reduce factually reduce the cases in which a controller would prepare a DPIA, resulting in a lower level of data protection but less administrative work for controllers.
#1217 Article 35 – paragraph 6 (Article 3 – paragraph 1 – point 9 – point a)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 6
Text proposed by the Commission
6. The Board shall prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments.Amendment
6. The Board shall establish a common template and a common methodology for conducting data protection impact assessments.
noyb's comment:
Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.
#1224 Article 35 – paragraph 6a (Article 3 – paragraph 1 – point 9 – point b)
Authored by
Regulation (EU) 2016/679
Article 35 – paragraph 6a
Text proposed by the Commission
6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).Amendment
6a. The proposal for the list referred to in paragraph 4 and for the template and methodology referred to in paragraph within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2). That list shall be based on convergence area from national authorities and shall not introduce new categories of processing operations that go beyond existing obligations under this Regulation. Processing operations lawfully in place at the time of their initiation shall not be subject to a retroactive obligation to carry out a data protection impact assessment as a result of the adoption of the harmonised list.
noyb's comment:
This proposal (apparently subject to editorial mistakes) tries to narrow the scope of potential processing activities subject to a DPIA; therefore, it lowers the level of data protection. It also introduces some legal uncertainty, offsetting a potential reduction in administrative workload.
#1238 Article 37 – paragraph 4 (Article 3 – paragraph 1 – point 9 a (new))
Authored by
Regulation (EU) 2016/679
Article 37 – paragraph 4
Present text
4. In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may or, where required by Union or Member State law shall, designate a data protection officer. The data protection officer may act for such associations and other bodies representing controllers or processors.Amendment
9a. In Article 37, paragraph 4 is replaced by the following: "4. In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may designate a data protection officer. The data protection officer may act for such associations and other bodies representing controllers or processors."Justification
DPO Package #2: The amendment strengthens accountability by recognising DPOs as practical governance safeguards and first points of contact for complaints. DPOs already advise controllers and processors, monitor compliance and support data subjects; giving them an explicit complaint-handling role makes resolution faster, less bureaucratic and closer to the facts. Voluntary or shared DPOs are encouraged. Supervisory authorities remain available where the complaint is not addressed or not fully remedied within one month.
noyb's comment:
The proposal deletes the option to introduce the requirement to appoint a DPO by Member State or Union law. E.g. in case a specific processing activity subject to a Member State or Union law is considered quite risky they could require the appointment of a DPO even if the requirements in Article 37(1) are not met. While this potentially reduces the level of data protection, it reduces compliance efforts by the controller who does not have to check potential additional obligations to appoint a DPO.
#1240 Article 39 – paragraph 1 – point ea (new) (Article 3 – paragraph 1 – point 9 b (new))
Authored by
Regulation (EU) 2016/679
Article 39 – paragraph 1 – point ea (new)
Present text
No equivalentAmendment
9b. In Article 39, paragraph 1 the following point ea is added: "'(ea) to handle complaints from a data subject or complaints from a body, organisation or association pursuant to Article 80 against the processing of personal data by the controller or the processor, to investigate the subject matter of the complaint to an appropriate extent, and to advise the controller or the processor on appropriate remedial measures in the event of a breach of this Regulation.'"Justification
DPO Package #3: The amendment strengthens accountability by recognising DPOs as practical governance safeguards and first points of contact for complaints. DPOs already advise controllers and processors, monitor compliance and support data subjects; giving them an explicit complaint-handling role makes resolution faster, less bureaucratic and closer to the facts. Voluntary or shared DPOs are encouraged. Supervisory authorities remain available where the complaint is not addressed or not fully remedied within one month.
noyb's comment:
While the DPO should be involved when complaints or lawsuits are filed against the controller, the DPO should not be tasked to handle those as this would be a massive conflict of interest since this would naturally entail defending the controller against any allegations made. (See Art-19 WP WP 243 rev.01 Guidelines on Data Protection Officers, p 19)
#1254 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 1
Text proposed by the Commission
(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.Amendment
(1) The Commission may adopt implementing acts to specify technical and organisational measures and criteria supporting controllers in assessing whether data resulting from anonymisation or pseudonymisation no longer constitutes personal data for certain entities and in preventing the risk of re-identification.
noyb's comment:
The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1) and 4(6).
#1258 Article 41 – paragraph 1 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41 – paragraph 1
Text proposed by the Commission
(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.Amendment
(1) The Commission may adopt implementing acts providing specifications, criteria, methodologies and practical requirements necessary to ensure the uniform application of this Regulation throughout the Union.Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
The power to make such decisions lies with independet SAs under Article 8(3) of the Charter. This would allow the (political) COM to interfere with the rights of SAs.
#1265 Article 41 – paragraph 2 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41 – paragraph 2
Text proposed by the Commission
(2) For the purpose of paragraph 1 the Commission shall:Amendment
(2) 2. Implementing acts adopted under paragraph 1 may in particular:Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not change anything material in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights.
#1267 Article 41a – paragraph 2 – point a (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
Text proposed by the Commission
(a) assess the state of the art of available techniques;Amendment
(a) specify criteria and methodologies for assessing whether data resulting from anonymisation or pseudonymisation can reasonably be used to identify or re-identify a natural person;Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not change anything material in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1269 Article 41a – paragraph 2 – point a (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
Text proposed by the Commission
(a) assess the state of the art of available techniques;Amendment
(a) assess the state of the art of available techniques, such as privacy- enhancing technologies;
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1275 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
Text proposed by the Commission
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.Amendment
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data, taking into account objective factors such as cost, amount of time required, available technology, legal obligations.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1280 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
Text proposed by the Commission
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.Amendment
(b) specify methodologies for assessing risks to the rights and freedoms of natural persons;Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1281 Article 41a – paragraph 2 – point ba (new) (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point ba (new)
Text proposed by the Commission
Amendment
(ba) In Article 41a, paragraph 2, the following point ba is added: '(ba) assess technical, administrative, organisational and contractual measures that can prevent the risk of re-identification.'
noyb's comment:
Does not add anything material towards the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1282 Article 41a – paragraph 2 – point ba (new) (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point ba (new)
Text proposed by the Commission
Amendment
(ba) In Article 41a, paragraph 2, the following point ba is added: '(ba) establish or approve Union-wide Codes of Conduct pursuant to Article 40 where harmonised application is necessary;'Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1283 Article 41a – paragraph 2 – point bb (new) (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point bb (new)
Text proposed by the Commission
Amendment
(bb) In Article 41a, paragraph 2, the following point ba is added: '(bb) establish or approve Certification mechanisms, seals and marks pursuant to Article 42, including certification criteria and conditions for accreditation of certification bodies;'Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1284 Article 41a – paragraph 2 – point bc (new) (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point bc (new)
Text proposed by the Commission
Amendment
(bc) In Article 41a, paragraph 2, the following point ba is added: '(bc) specify common technical and organisational measures that may be used to demonstrate compliance with this Regulation;'Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1285 Article 41a – paragraph 2 – point bd (new) (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point bd (new)
Text proposed by the Commission
Amendment
(bd) In Article 41a, paragraph 2, the following point ba is added: '(bd) identify sector-specific circumstances, processing operations or use cases where harmonised interpretation is necessary to avoid fragmentation of the internal market.'Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1289 Article 41a – paragraph 3 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 3
Text proposed by the Commission
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.Amendment
(3) The implementation of the technical and organisational measures and criteria outlined in an implementing act may be used as an element to demonstrate that pseudonymised data do not lead to reidentification of the data subjects in a specific case.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1293 Article 41a – paragraph 3 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 3
Text proposed by the Commission
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.Amendment
(3) Compliance with specifications, criteria or methodologies set out in implementing acts adopted under this Article may be used by controllers and processors as an element to demonstrate compliance with this Regulation.Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.
#1297 Article 41 – paragraph 4 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41 – paragraph 4
Text proposed by the Commission
(4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.Amendment
(4) The Commission shall closely involve the European Data Protection Board in the preparation of implementing acts under this Article. The European Data Protection Board shall issue an opinion within eight weeks of receipt of the draft implementing act.Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Decisions on the application of the law are generally reserved to independent SAs under Article 8(3) of the Charter.
#1300 Article 41a – paragraph 5 (Article 3 – paragraph 1 – point 10)
Authored by
Regulation (EU) 2016/679
Article 41a – paragraph 5
Text proposed by the Commission
(5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).Amendment
(5) The implementing acts referred to in this Article shall be adopted in accordance with the examination procedure referred to in Article 93(3).Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
noyb's comment:
The amendment does not include any new substantive element.
#1303 Article 42 – paragraphs 3 and 7 (Article 3 – paragraph 1 – point 10 a (new))
Authored by
Regulation (EU) 2016/679
Article 42 – paragraphs 3 and 7
Present text
3. The certification shall be voluntary and available via a process that is transparent. 7. Certification shall be issued to a controller or processor for a maximum period of three years and may be renewed, under the same conditions, provided that the relevant criteria continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the criteria for the certification are not or are no longer met.Amendment
10a. In Article 42, paragraph 3 and 7 are amended as follows: "3. The certification shall be voluntary and available via a process that is transparent for small and medium controllers and large processors. Large controllers must be certified within one year after meeting the conditions in Article 4(28). 7. Certification shall be issued to a controller or processor for a maximum period of three years for small and medium controller and large processors. Certifications shall be issued for a maximum period of one year for large controllers. It may be renewed, under the same conditions, provided that the relevant criteria continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the criteria for the certification are not or are no longer met."Justification
RISK-BASED APPROACH #11: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
Part of a larger package. This would introduce certification for large controllers, which can also lower transaction costs for other controllers engaging with them and limit the need of resources by SAs.
#1305 Article 43 – paragraphs 2 and 7 (Article 3 – paragraph 1 – point 10 b (new))
Authored by
Regulation (EU) 2016/679
Article 43 – paragraphs 2 and 7
Present text
2. Certification bodies referred to in paragraph 1 shall be accredited in accordance with that paragraph only where they have: 7. Without prejudice to Chapter VIII, the competent supervisory authority or the national accreditation body shall revoke an accreditation of a certification body pursuant to paragraph 1 of this Article where the conditions for the accreditation are not, or are no longer, met or where actions taken by a certification body infringe this Regulation.Amendment
10b. In Article 43, paragraphs 2 and 7 are replaced by the following: "2. Certification bodies referred to in paragraph 1 shall be accredited in accordance with that paragraph only where they have: (ea) have not repeatedly and knowingly certified processing or other conduct that clearly violated guidelines or recommendation under Article 70(1)(d) that was issued before the certification or have not repeatedly and knowingly certified processing that was later subject to corrective powers under Article 58(2) or fines under Article 83. 7. Without prejudice to Chapter VIII, the competent supervisory authority or the national accreditation body shall revoke an accreditation of a certification body pursuant to paragraph 1 of this Article where the conditions for the accreditation are not, or are no longer, met or where actions taken by a certification body infringe this Regulation. Supervisory authorities shall report complaints under Article 77, any exercise of corrective powers under Article 58(2) and any fine under Article 83 against a controller or processor that was certified to the relevant certification body and the competent supervisory authority that has accredited the relevant certification body."Justification
RISK-BASED APPROACH #12: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
Part of a package. Overall increased simplification and privacy.
#1306 Article 43a (Article 3 – paragraph 1 – point 10 c (new))
Authored by
Regulation (EU) 2016/679
Article 43a
Present text
No equivalentAmendment
10c. The following article is inserted: "Article 43a Common templates and common methodologies 1. The Board may prepare and transmit to the Commission a proposal for a list of situations which clearly are or are not subject to the requirement described in Articles 27(2), 33(1), 34(1) and (3), 35(1) and (3), and 37(1)(b) and (c). 2. The Board may prepare and transmit to the Commission a proposal for a common template and a common methodology for providing information or conducting assessments under Articles 13, 14, 24, 25, 30 and 32 to 36. 3. The proposals for the lists referred to in paragraphs 41 and for the templates and methodologies referred to in paragraph 62 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2). 4. The lists and the templates and methodolog referred to in paragraph 3 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 3. 5. Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Commission adopts the implementing act referred to in paragraph 3."Justification
The amendment turns GDPR harmonisation into practical compliance relief by enabling EU-level black and white lists, templates and methodologies for recurring duties such as DPIAs, breach notifications, transparency information, records and accountability measures. This reduces divergent national expectations, duplicated assessments and over-compliance for cross-border controllers. EDPB preparation preserves expertise, Commission implementing acts provide legal certainty, and regular reviews keep the tools adaptable.
noyb's comment:
Templates make application of the law simpler. The fact that only situations which do not fall under the relevant Articles are codified would typcially overall lead to the lowering of standards.
#1307 Article 44 – paragraphs 1, 1a, 1b (new) (Article 3 – paragraph 1 – point 10 d (new))
Authored by
Regulation (EU) 2016/679
Article 44 – paragraphs 1, 1a, 1b (new)
Present text
1. Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.Amendment
10d. In Article 44, the first paragraph is amended and the following paragraphs 1a and 1b are inserted: "1. Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the standard of the protection provided for data subjects with regard to general processing of personal data in the third country or by the international organisation is not materially lower than the standard of the protection provided for data subjects by this Regulation. 1a. In order to ensure a coherent and proportionate application of this Regulation, the assessment of safeguards for transfers of personal data to third countries should take into account the risk-based approach applicable under Articles 24 and 32, including the nature, scope, context and purposes of the processing, as well as the technical and organisational measures implemented by controllers and processors. Such assessment should not affect the requirement that data subjects whose personal data are transferred to third countries continue to benefit from a level of protection of fundamental rights and freedoms essentially equivalent to that guaranteed within the Union, in accordance with the Charter of Fundamental Rights of the European Union and the case law of the Court of Justice of the European Union. 1b. To support efficient data transfers within multinational corporate groups, supervisory authorities should take into account whether companies apply common internal data protection, security and compliance standards across the group. Where a group has binding internal rules, effective safeguards, and mechanisms to protect data subjects’ rights and remedies, this may create a rebuttable presumption that appropriate safeguards under Article 46 are met. Such presumption should not reduce the level of protection guaranteed under this Regulation, the Charter of Fundamental Rights of the European Union, or the case law of the Court of Justice of the European Union, including regarding access to data by public authorities in third countries."Justification
The amendments support necessary cross-border data flows for EU companies in global value chains, cloud services and multinational groups. Transfer assessments must remain aligned with the Charter and CJEU case law, but should apply a risk-based and proportionate assessment of the safeguards actually used. Where groups apply binding internal rules, common security standards and effective remedies, a rebuttable presumption under Article 46 can reduce formalism without lowering protection or ignoring public-authority access risks.
noyb's comment:
The proposed additions contradict themselves, by proposing a "not materially lower" stardard of protection in paragraph 1 and then "essentially equivalent level of protection" in paragraph 1a. The proposed rebuttable presumption of compliance with the safeguards of Article 46 does not include contestability rights for data subjects.
#1308 Article 45 (Article 3 – paragraph 1 – point 10 e (new))
Authored by
Regulation (EU) 2016/679
Article 45
Present text
1. A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. 2. Such a transfer shall not require any specific authorisation.When assessing the adequacy of the level of protection, the Commission shall, in particular, take account of the following elements: (a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred; (b) the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with the data protection rules, including adequate enforcement powers, for assisting and advising the data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and (c) the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data. 3. The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. 4The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2). 4. The Commission shall, on an ongoing basis, monitor developments in third countries and international organisations that could affect the functioning of decisions adopted pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC. 5. The Commission shall, where available information reveals, in particular following the review referred to in paragraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or an international organisation no longer ensures an adequate level of protection within the meaning of paragraph 2 of this Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by means of implementing acts without retro-active effect. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). On duly justified imperative grounds of urgency, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 93(3). 6. The Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation giving rise to the decision made pursuant to paragraph 5. 7. A decision pursuant to paragraph 5 of this Article is without prejudice to transfers of personal data to the third country, a territory or one or more specified sectors within that third country, or the international organisation in question pursuant to Articles 46 to 49. 8. The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that an adequate level of protection is or is no longer ensured. 9. Decisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article.Amendment
10e. Article 45 replaced by the following: "Article 45 Transfers on the basis of an adequacy decision 1. A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures standard of protection which is not materially lower than the standard provided by this Regulation. Such a transfer shall not require any specific authorisation. 2. Such a transfer shall not require any specific authorisation. When assessing the standard of protection, the Commission shall, in particular, take account of the following elements: (a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred; (b) the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with the data protection rules, including adequate enforcement powers, for assisting and advising the data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and (c) the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data. 3. The Commission, after assessing the standard of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an approved standard of protection within the meaning of paragraph 1 and 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2). 4. The Commission shall, on an ongoing basis, monitor developments in third countries and international organisations that could affect the functioning of decisions adopted pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC. 5. The Commission shall, where available information reveals, in particular following the review referred to in paragraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or an international organisation no longer ensures an sufficient level of protection within the meaning of paragraph 1 and 2 of this Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by means of implementing acts without retro-active effect. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). 6. The Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation giving rise to the decision made pursuant to paragraph 5. 7. A decision pursuant to paragraph 5 of this Article is without prejudice to transfers of personal data to the third country, a territory or one or more specified sectors within that third country, or the international organisation in question pursuant to Articles 46 to 49. 8. The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that the approved level of protection is or is no longer ensured. 9. Decisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article."Justification
The amendments support necessary cross-border data flows for EU companies in global value chains, cloud services and multinational groups. Transfer assessments must remain aligned with the Charter and CJEU case law, but should apply a risk-based and proportionate assessment of the safeguards actually used. Where groups apply binding internal rules, common security standards and effective remedies, a rebuttable presumption under Article 46 can reduce formalism without lowering protection or ignoring public-authority access risks.
noyb's comment:
As with the previous amendment, the essentially equivalent level of protection is proposed to be undermined to "not materially lower than the standard of the Regulation". Additionally, the option for the Commission to urgently adopt implementing acts is proposed to be removed, which could jeopardise the level of protection of the data subjects in urgent situations, that might require the suspension/amendment or repealing of an implementing act. In light of the "Schrems" decisions, this would also likely violate the Charter.
#1309 Article 49 – paragraph 1 (Article 3 – paragraph 1 – point 10 f (new))
Authored by
Regulation (EU) 2016/679
Article 49 – paragraph 1
Present text
Article 49 Derogations for specific situations 1. In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:Amendment
10f. In Article 49, the first paragraph is ammended: "Article 49 Derogations for specific situations 1. In the absence of a decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:"Justification
The amendments support necessary cross-border data flows for EU companies in global value chains, cloud services and multinational groups. Transfer assessments must remain aligned with the Charter and CJEU case law, but should apply a risk-based and proportionate assessment of the safeguards actually used. Where groups apply binding internal rules, common security standards and effective remedies, a rebuttable presumption under Article 46 can reduce formalism without lowering protection or ignoring public-authority access risks.
noyb's comment:
This proposal undermines the level of protection that is currently enshrined in the GDPR and the CFREU.
#1312 Article 57 – paragraph 1 – point aa (new) (Article 3 – paragraph 1 – point 11 – point a a (new))
Authored by
Regulation (EU) 2016/679
Article 57 – paragraph 1 – point aa (new)
Text proposed by the Commission
Amendment
(aa) In Article 57, paragraph 1, the following point aa is inserted: '(aa) handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80 and investigate, in the case of a complaint by a data subject at its discretion, to the extent approriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisor authority is necessary;'
noyb's comment:
The amendment gives more discretion to supervisory authorities, which could lead to less complaint handling. The lack of a remedy (beyond civil courts) could violate Article 8(3) and 47 of the Charter.
#1313 Article 57 – paragraph 1 – point d (Article 3 – paragraph 1 – point 11 – point a a (new))
Authored by
Regulation (EU) 2016/679
Article 57 – paragraph 1 – point d
Present text
promote the awareness of controllers and processors of their obligations under this Regulation;Amendment
(aa) In Article 57, paragraph 1, point d is amended as follows: "(d) promote the awareness of controllers and processors of their obligations under this Regulation, and in doing so due regard is given to the principle of proportionality, taking into account the nature, scope, context, risk, and purposes of the processing, while coordinating, where applicable, with the relevant competent sectoral authorities."Justification
INNOVATION PACKAGE #2: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
While it reflects a risk-based approach, the amendment does not directly impact controllers or data subjects.
#1314 Article 57 – paragraph 1 – va (Article 3 – paragraph 1 – point 11 – point a b (new))
Authored by
Regulation (EU) 2016/679
Article 57 – paragraph 1 – va
Text proposed by the Commission
Amendment
(ab) In Article 57, paragraph 1, the following point va is added: '(va) set up regulatory sandboxes to facilitate testing the compliance of specific techniques or technological solutions to be used for the data processing activities with the obligations under this Regulation or whether the data processing results in data that would be exempt from this Regulation.'
noyb's comment:
The amendment provides for compliance tools to be put in place by the supervisory authorities, ultimately shifting compliance to them. The fact that a full excemption from the Regulation is granted would undermine the rights under the GDPR.
#1315 Article 57 – paragraph 1 – point f (Article 3 – paragraph 1 – point 11 – point a b (new))
Authored by
Regulation (EU) 2016/679
Article 57 – paragraph 1 – point f
Present text
handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;Amendment
(ab) In Article 57, paragraph 1, point f is amended: "(f) in handling complaints, the supervisory authority may determine the order of priority according to the seriousness of the alleged infringement and its impact on the rights of data subjects, and may allocate its investigative resources accordingly, provided that each complaint is handled with due diligence;"Justification
INNOVATION PACKAGE #3: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
The amendmentincreases the discretion of supervisory authorities to set their priorities. It would likely be read to allow to ignore many complaints.
#1316 Article 57 – paragraph 2 (Article 3 – paragraph 1 – point 11 a (new))
Authored by
Regulation (EU) 2016/679
Article 57 – paragraph 2
Present text
2. Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.Amendment
11a. In Article 57, paragraph 2 is amended as follows: "2. Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form. Supervisory authority may establish the mandatory use of electronical forms and set up conditions for other means of communication in exceptional cases."Justification
INNOVATION PACKAGE #4: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
The amendment excludes other means of communication with the supervisory authorities, however this could simplify processnig of complaints. Some Member States already have such limitations in national law or practice.
#1317 Article 57 – paragraphs 4a, 4b, 4c (new) (Article 3 – paragraph 1 – point 11 b (new))
Authored by
Regulation (EU) 2016/679
Article 57 – paragraphs 4a, 4b, 4c (new)
Present text
No equivalentAmendment
11b. In Article 57, the following paragraphs are added: "4a. In fullfilling their tasks supervisory authorities shall take into account that the right to the protection of personal data is not an absolute right and must be considered in relation to its function in society and balanced against other fundamental rights, in accordance with the principle of proportionality. They must have inter alia regard of the following as far as relevant in the specific circumstances: (a) the desirability of promoting innovation; (b) the desirability of promoting competition; (c) the importance of the prevention, investigation, detection and prosecution of criminal offences; (d) the need to safeguard public security and national security; (e) the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing. 4b. Supervisory authorities shall, where appropriate, consult and cooperate on national and Union as well as in appropriate cross-border procedures with other regulatory bodies, whose regulatory tasks and powers might are related to the protection of personal data and the free flow of personal data within the Union. When consulting those and cooperating with those other regualtory bodies supervisory authorities praticularly shall take into account the matters according to paragraph 5. The Commission may adopt, by means of an implementing act, procedural rules for the sharing of personal data, business secrets, purpose limititation and other procedural aspects necessary to ensure professional secrecy. 4c. Supervisory authority shall establish a permanent panel of stakeholder representatives to ensure that they fulfill their tasks, especially regarding the matters described in paragraph 4 duely and monitor relevant developments, insofar as they have an impact on the protection of personal data and the free flow of personal data, in particular the development of information and communication technologies and commercial practices. The Commission may adopt, by means of an implementing act, rules for the appointement and the statue oft he members oft he panel and procedural requirements which ensure professional secrecy and transparency."Justification
INNOVATION PACKAGE #5: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
The amendment provides for a balancing test that is not in favor of privacy, for stakeholders bodies that impair the supervisory authorities' independence and for new implementing acts that could lead to uncertainty.
#1318 Article 58 – paragraph 2a (new) (Article 3 – paragraph 1 – point 11 c (new))
Authored by
Regulation (EU) 2016/679
Article 58 – paragraph 2a (new)
Present text
No equivalentAmendment
11c. In Article 58 the following paragraph 2a is added: "(2a) When deciding whether and which of the corrective powers referred to in paragraph 2 to exercise, the supervisory authority shall act according to its dutiful discretion, having regard to the criteria listed in Article 83(2), to the effective protection of the data subject and to the efficient use of its resources. It may refrain from exercising a corrective power where the infringement is minor or has been remedied and its exercise is not necessary to ensure compliance with this Regulation. The obligation to ensure that infringements are brought to an end remains unaffected."Justification
INNOVATION PACKAGE #6: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
Less protection and compliance due to less excercise of corrective powers.
#1320 Article 70 – paragraph 1 – point e (Article 3 – paragraph 1 – point 12 a (new))
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point e
Present text
(e) examine, on its own initiative, on request of one of its members or on request of the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation;Amendment
12a. In Article 70, paragraph 1, point e is amendend as follows: "(e) examine, on its own initiative, on request of one of its members or on request of the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation; in doing so, the Board shall ensure that such guidance: i. remains consistent with the wording, scope, objectives, and risk-based structure of this Regulation, ii. respects the principles of proportionality and legal certainty and does not introduce substantive obligations beyond those laid down in Union law, iii. is accompanied by a published legal assessment confirming its legal basis, feasibility, and conformity with the principles of this Regulation, iv. where applicable, informed by, and coordinated with relevant competent sectoral authorities."Justification
INNOVATION PACKAGE #7: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
This proposal adds to the administrative workload of the EDPB and adds to uncertainty when documents produced by the EDPB do not clearly follow all these vague requirements. The amendment also apparently aims at lowering the level of data protection by emphasising an allege "risk-based" structure of the GDPR (which does not apply to the whole GDPR) and the fact that no further obligations should be introduced.
#1326 Article 70 – paragraph 1 – point ha (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point ha
Text proposed by the Commission
(ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35.Amendment
(ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment, pursuant to Article 35.
noyb's comment:
On its own, this amendment has no significant impact. Clear lists simplify the application of the law.
#1331 Article 70 – paragraph 1 – point hb (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hb
Text proposed by the Commission
(hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.Amendment
(hb) establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.
noyb's comment:
This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.
#1336 Article 70 – paragraph 1 – point hc (Article 3 – paragraph 1 – point 14)
Authored by
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc
Text proposed by the Commission
(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33Amendment
(hc) establish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33
noyb's comment:
This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.
#1345 Article 83 – paragraph 5a (new) (Article 3 – paragraph 1 – point 14 a (new))
Authored by
Regulation (EU) 2016/679
Article 83 – paragraph 5a (new)
Present text
No equivalentAmendment
14a. Article 83 is amended by adding the following paragraph 5a: "5a. By derogation from paragraph 4, 5 and 6, small controllers shall be subject to administrative fines of up to 50 000 EUR."Justification
RISK-BASED APPROACH #13: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
noyb's comment:
Lower fines would lead to more small controllers taking the risk of a small fine; therefore, practically reducing the level of data protection.
#1347 Article 71 – paragraph 2a (new) (Article 3 – paragraph 1 – point 14 b (new))
Authored by
Regulation (EU) 2016/679
Article 71 – paragraph 2a (new)
Present text
Article 71 ReportsAmendment
14b. In Article 71, the title is amended and the follow paragraph 2a is added: "Article 71 Reports, Data Protection Data Space 2a. The Board ensures public access to supervisory authorities‘ activity reports according to Article 59. The Board establishes a Data Protection Data Space which contains in electrionacally usable format: a) the reports published according to Paragraph 1 and Article 59; b) relevant decisions of supervisory authorties in national and cross border cases; c) statistical informations provided by the supervisory authorities about data breach notifictions and complaints; d) guidelines an other public available advise to raise awareness and support the coherent application of this Regulation, regardless wether published by the Board or supervisory authorities. The Commission may adopt, by means of an implementing act, rules which ensures access to the data base for research purposes, guardrails ensuring data protection and professional secrecy, purpose limitation and conditions for the secondary use of the data contained in the Data Protection Data Space."Justification
INNOVATION PACKAGE #8: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
This amendment itself would not significantly affect the level of privacy. But the Clarity provided could lead to some simplification.
#1352 Article 77 – paragraph 2 (Article 3 – paragraph 1 – point 14 c (new))
Authored by
Regulation (EU) 2016/679
Article 77 – paragraph 2
Present text
2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.Amendment
14c. In Article 77, paragraph 2 is replaced by the following: "2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78. Where the controller has appointed a data protection officer in accordance with Article 37, a complaint to the supervisory authority shall be admissible only if the data subject has previously lodged the complaint with the controller or the processor and the latter has not addressed the complaint, or has not fully addressed it, within one month of receiving the complaint."Justification
DPO Package #4: The amendment strengthens accountability by recognising DPOs as practical governance safeguards and first points of contact for complaints. DPOs already advise controllers and processors, monitor compliance and support data subjects; giving them an explicit complaint-handling role makes resolution faster, less bureaucratic and closer to the facts. Voluntary or shared DPOs are encouraged. Supervisory authorities remain available where the complaint is not addressed or not fully remedied within one month.
noyb's comment:
The Amendment limits access to the Supervisory Authority. DPOs are also not meant to be "complaint handling bodies" within the controller (see tasks in Article 39(1) GDPR), but mainly act as independent watchdogs. The additional steps and durations would make the process less simple, especially in urgent cases (e.g. urgent deletion of unlawful content online).
#1353 Article 80 – paragraphs 1 and 2 (Article 3 – paragraph 1 – point 14 d (new))
Authored by
Regulation (EU) 2016/679
Article 80 – paragraphs 1 and 2
Present text
Article 80 Representation of data subjects 1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law. 2. Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject's mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.Amendment
14d. In Article 80, paragraphs 1 and 2 are replaced by the following: "Article 80 Representation of data subjects 1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77 and 78 and the right referred to in Article 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law, with the exception of the right to claim compensation and liability under Article 82. 2. Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject's mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the right referred to in Article 78 and 79, with the exception of the right to claim compensation and liability under Article 82, if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing."Justification
The amendment preserves representative complaints and judicial remedies while clarifying that compensation under Article 82 remains a personal claim requiring proven damage. Non-material damage should be compensable where the infringement causes a significant impairment, ensuring effective redress without turning minor or purely formal infringements into mass claims. This protects data subjects’ individual rights, legal certainty for controllers and processors, and a proportionate balance between enforcement and liability.
noyb's comment:
The amendment excludes representation of the data subjects for enforcing the right to compensation. This Amendment is in conflict with the collective redress directive.
#1356 Article 82 (Article 3 – paragraph 1 – point 14 e (new))
Authored by
Regulation (EU) 2016/679
Article 82
Present text
Article 82 Right to compensation and liability 1. Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.Amendment
14e. In Article 82, the first paragraph is replaced by the following: "Article 82 Right to compensation and liability 1. Any data subject who has suffered proven material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered. A claim for compensation for non-material damage arises only in the event of a significant impairment."Justification
The amendment preserves representative complaints and judicial remedies while clarifying that compensation under Article 82 remains a personal claim requiring proven damage. Non-material damage should be compensable where the infringement causes a significant impairment, ensuring effective redress without turning minor or purely formal infringements into mass claims. This protects data subjects’ individual rights, legal certainty for controllers and processors, and a proportionate balance between enforcement and liability.
noyb's comment:
The amendment restricts the scope of the right to compensation.
#1357 Article 70 – paragraphs 4a, 4b (new) (Article 3 – paragraph 1 – point 14 f (new))
Authored by
Regulation (EU) 2016/679
Article 70 – paragraphs 4a, 4b (new)
Text proposed by the Commission
Amendment
14f. In Article 70, paragraphs 4a and 4b are added: "4a. In fullfilling ist tasks the Board takes into account that the right to the protection of personal data is not an absolute right and must be considered in relation to its function in society and balanced against other fundamental rights, in accordance with the principle of proportionality. The Board must have inter alia regard of the following as far as relevant in the specific circumstances: (a) the desirability of promoting innovation; (b) the desirability of promoting competition; (c) the importance of the prevention, investigation, detection and prosecution of criminal offences; (d) the need to safeguard public security and national security; (e) the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing. 4b. The Board shall establish a permanent panel of stakeholder representatives to ensure that it fulfills its tasks, especially regarding the matters described in paragraph 5 duely and monitor relevant developments, insofar as they have an impact on the protection of personal data and the free flow of personal dada, in particular the development of information and communication technologies and commercial practices. The Commission may adopt, by means of an implementing act, rules for the appointement and the statue oft he members oft he panel and procedural requirements which ensure professional secrecy and transparency. "Justification
INNOVATION PACKAGE #8: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
noyb's comment:
This amendment highlights (and therefore pushes) the limits to data protection, effectively lowering the level of data protection. At the same time, these considerations do not provide for any significant simplification.
#1362 Article 88a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a
Text proposed by the Commission
Article 88aAmendment
deleted
#1394 Article 88a – paragraph 3 – point c (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c
Text proposed by the Commission
(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;Amendment
(c) (c) creating information about the usage of an online service to measure the audience of such a service, where it is carried out at the direction of the controller of that online service, or by a third party acting on behalf of the controller;
#1405 Article 88a – paragraph 3 – point da (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)
Text proposed by the Commission
Amendment
(da) In Article 88a, paragraph 3, the following point da is added: '(da) ‘legitimate interests’ according to Article 6(1)(f) of this regulation provided that the controller applies Privacy Enhancing Technologies (PETs) in accordance with the technical standards adopted pursuant to Article 25a. This point shall not apply to processing operations that involve tracking or profiling a data subject's behaviour for the purposes of behavioural advertising, where the advertising itself is directly generating revenue for the controller, or where there is no direct relationship with the data subject.'
noyb's comment:
New exception introduced. Very vague, mixing different concepts (personal data, legitimate interest and PETs).
#1412 Article 88a – paragraph 3 – point db (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point db (new)
Text proposed by the Commission
Amendment
(db) In Article 88a, paragraph 3, the following point db is added: '(db) performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083.'
#1427 Article 88a – paragraph 4 – point a (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point a
Text proposed by the Commission
(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;Amendment
(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner, or be presented with the option to decline consent and proceed to a paid alternative;
#1436 Article 88a – paragraph 4 – point c (Article 3 – paragraph 1 – point 15)
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c
Text proposed by the Commission
(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.Amendment
(c) Where data subject refuse request for consent presented by media service providers, Media service providers shall be able to offer data subjects an equivalent alternative that is not accompanied by the processing of personal data for audience-based advertising purposes, where appropriate for a reasonable fee.
noyb's comment:
Limits the proposal of the Commission to media service providers and rewrites it to introduce payment for refusing consent, but is unclear about the details. Questionable from an equality before the law perspective.
#1445 Article 88b (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b
Text proposed by the Commission
Article 88bAmendment
deleted
#1455 Article 88b – title (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – title
Text proposed by the Commission
Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural personsAmendment
Voluntary automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons
noyb's comment:
Significantly weakens the positive Commission proposal. A voluntary system would be chaotic and hardly functioning (see "DNT").
#1550 Article 88b – paragraph 7a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88b – paragraph 7a (new)
Text proposed by the Commission
Amendment
(7a) In Article 88b, the following paragrpah is added: '7a. The Commission shall, by [insert date = 3 years after the date of entry into force of this Regulation], submit a report to the European Parliament and the Council on the functioning of this Article, including an assessment of: (a) the impact on user choice and competition; (b) the effectiveness of machine-readable indications in reducing consent fatigue; (c) the emergence of new gatekeeper risks; (d) the impact on European media service providers; and (e) the need for legislative amendment.'
#1561 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 1
Text proposed by the Commission
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Amendment
Where the processing of personal data is necessary for the interests of the controller, or a third party, in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, including a general-purpose AI model as defined in Article 3, point (63) of Regulation (E) 2024/1689, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of this Regulation except where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child and except where other Union explicitly require consent. The processing of personal data in the context of the development and operation of an AI system may also be based for the performance of a task carried out by public authorities in the public interest pursuant to Article 6, paragraph 1, point (e) and paragraph 2.
#1566 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 1
Text proposed by the Commission
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.Amendment
Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data.Justification
Europe needs a clear, harmonised lawful basis for responsible AI development and operation. Divergent interpretations of legitimate interest create uncertainty, compliance costs and incentives to train, test and validate AI outside Europe. The amendment confirms that Article 6(1)(f) may apply where processing is necessary and balanced against data-subject rights, while preserving consent requirements, the duty to choose the correct lawful basis and safeguards against disclosure of residually retained data.
noyb's comment:
The amendment removes the option for Member States to require consent and removes the mention to the rights of children.
#1581 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2
Text proposed by the Commission
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.Amendment
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects.Justification
Europe needs a clear, harmonised lawful basis for responsible AI development and operation. Divergent interpretations of legitimate interest create uncertainty, compliance costs and incentives to train, test and validate AI outside Europe. The amendment confirms that Article 6(1)(f) may apply where processing is necessary and balanced against data-subject rights, while preserving consent requirements, the duty to choose the correct lawful basis and safeguards against disclosure of residually retained data.
noyb's comment:
The amendment includes more derogations than the Commission's proposal.
#1587 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2
Text proposed by the Commission
Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.Amendment
Any such processing shall be subject to appropriate organisational, technical and legal measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects.
noyb's comment:
The amendment pushes against the right to object in proposed Article 88c.
#1592 Article 88c – paragraph 2a (new) (Article 3 – paragraph 1 – point 15)
Authored by
Regulation (EU) 2016/679
Article 88c – paragraph 2a (new)
Text proposed by the Commission
Amendment
In Article 88c, the following paragraph is added: '2a. This does not affect the obligation of the controller to choose the most appropriate lawful ground of processing set out in Article 6 of Regulation (EU) 2016/679, such as Article 6(1)(e) with regard to processing by public authorities.'Justification
Europe needs a clear, harmonised lawful basis for responsible AI development and operation. Divergent interpretations of legitimate interest create uncertainty, compliance costs and incentives to train, test and validate AI outside Europe. The amendment confirms that Article 6(1)(f) may apply where processing is necessary and balanced against data-subject rights, while preserving consent requirements, the duty to choose the correct lawful basis and safeguards against disclosure of residually retained data.
noyb's comment:
This amendment repeats existing obligations and options for controllers under the GDPR.
#1595 Annex 1a (new) (Article 3 – paragraph 1 – point 15 a (new))
Authored by
Regulation (EU) 2016/679
Annex 1a (new)
Present text
No equivalentAmendment
15a. After Annex 1, the following Annex is added: "ANNEX Ia Legitimate interests within the meaning of point (f) of the first subparagraph of Article 6 paragraph 1 include, but are not restricted to: 1. Legal and Regulatory Compliance a. preventing, detecting or investigating fraud and other criminal activities; b. ensuring workplace safety and security (eg, CCTV monitoring in public areas of the workplace or monitoring premises with sensitive operations); c. conducting audits or compliance checks; d. reporting illegal activities or threats to public safety to authorities; e. cooperating with authorities in situations of emergency. 2. Business Operations and Management a. ensuring the proper functioning of equipment, IT systems or infrastructure; b. ensuring network and information security (eg, preventing unauthorised access or cyberattacks) and preventing misuse of services or systems (eg, detecting bots or spam); c. protecting the controller’s or a third party’s assets, reputation, or intellectual property; d. establishing, exercising, or defending legal claims; e. monitoring business performance or productivity. 3. Research and Development a. conducting scientific or historical research; b. improving products or services (eg, based on customer feedback); c. developing new technologies or services (eg, training, validating or testing of artificial intelligence); d. clinical trials; e. archiving or statistical activities in the public interest. 4. Distribution and Marketing a. ensuring seamless transactions and user experiences on websites or apps; b. maintaining customer records for service continuity; c. conducting market research or customer satisfaction surveys; d. measuring the effectiveness of marketing campaigns. 5. Business Transactions a. transfers of employee, customer or supplier files within a group of companies; b. carrying out mergers, acquisitions, or similar business transactions; c. conducting due diligence in business transactions; d. assignment of claims, or provision of claims as a security, within common financial transactions. The fact that a processing operation is covered by subparagraph 1 does not exempt the controller from ensuring that the processing operation is necessary for the purposes of the relevant legitimate interests pursued by the controller or by a third party, and that the interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. In doing so, the controller shall take into account, among others, the possible consequences of the intended processing for data subjects and the existence of appropriate safeguards."Justification
The package makes Article 6 more predictable by clarifying that anonymisation may require a lawful processing step, recognising safeguarded intra-group administrative transfers, and adding a non-exhaustive Annex of legitimate-interest use cases. This supports consistent application across the Union without creating a blanket permission: necessity, proportionality and the balancing test remain required, especially for children. Commission updates after EDPB consultation keep the framework adaptable to new technologies and business practices.
noyb's comment:
The amendment includes a derogation in relation to Article 6(1)(f) which is not foreseen in the current regime. In general, the purposes behind legitimate interests should always be context specific, rather than standardised.
#1597 Article 88d (new) (Article 3 – paragraph 1 – point 15 b (new))
Authored by
Regulation (EU) 2016/679
Article 88d (new)
Text proposed by the Commission
Amendment
15b. A new Article 88d is added after Article 88c: 'Article 88d Processing of personal data in industrial operational environments 1. Where personal data are generated or collected by industrial machinery, industrial equipment, production systems or industrial internet-of-things devices in the course of their operation in an industrial operational environment, and are processed by a controller or processor solely for the purposes of operating, maintaining, monitoring, improving or securing such machinery, equipment, systems or devices, Articles 15 to 22, Article 30 and Article 35 shall not apply, provided that the conditions laid down in paragraph 2 are met. 2. Paragraph 1 shall apply only where the controller or processor, as applicable, implements appropriate technical and organisational measures to ensure that the personal data are pseudonymised, or that any identifiers that are not strictly needed for the purposes described in paragraph 1 are removed, and are not processed for the purpose of evaluating the performance, behaviour or conduct of an identified or identifiable natural person, and are not used to take a decision producing legal effects concerning a data subject or similarly significantly affecting him or her within the meaning of Article 22(1). 3. This Article shall not apply to the processing of special categories of personal data referred to in Article 9(1), nor to personal data relating to criminal convictions and offences referred to in Article 10.'Justification
Industrial machinery, production systems and IIoT devices generate operational data that may incidentally include identifiers such as user IDs, staff numbers or logs. Where processing is solely for operating, maintaining, improving or securing equipment, and not for monitoring workers or taking decisions about individuals, selected GDPR duties can be disproportionate. The amendment creates a narrow risk-based exemption, requiring pseudonymisation or identifier removal, excluding Article 9/10 data and preserving core GDPR principles, lawful basis and security duties.
noyb's comment:
This proposal targets data collected in an industrial environment and takes it out of the scope of most data subjects’ rights and some documentation obligations. While the provision also provides for safeguards, the level of data protection would still be reduced. The administrative burden due to the characterisation of this industrial data as personal data would be reduced.
#1598 Articles 88e, 88f, 88g (new) (Article 3 – paragraph 1 – point 15 c (new))
Authored by
Regulation (EU) 2016/679
Articles 88e, 88f, 88g (new)
Text proposed by the Commission
Amendment
15c. After Article 88c, the following Articles 88e, 88f, 88g are added: 'Article 88e Data protection regulatory sandboxes 1. Member States shall ensure that their competent supervisory authorities establish at least one data protection regulatory sandbox at national level, which shall be operational by 2 August 2028. That sandbox may also be established jointly with the supervisory authorities of other Member States. The Commission may provide technical support, advice and tools for the establishment and operation of data protection regulatory sandboxes. The obligation under the first subparagraph may also be fulfilled by participating in an existing sandbox in so far as that participation provides an equivalent level of national coverage for the participating Member States. This Chapter is without prejudice to the rules laid down by other Union legal acts related to regulatory sandboxs, in particular Chapter 6 of Regulation (EU) 2024/1689. 2. Additional data protection regulatory sandboxes at regional or local level, or established jointly with the supervisory authorities of other Member States may also be established. 3. The European Data Protection Supervisor may also establish an data protection regulatory sandbox for Union institutions, bodies, offices and agencies. For this purpose references to national supervisory authorities in this Chapter shall be construed as references to the European Data Protection Supervisor. 4. Member States shall ensure that the supervisory authorities referred to in paragraphs 1 and 2 allocate sufficient resources to comply with this Article effectively and in a timely manner. Where appropriate, national supervisory authorities shall cooperate with other relevant authorities, and may allow for the involvement of other actors within the data protection ecosystem. This Article shall not affect other regulatory sandboxes established under Union or national law. Member States shall ensure an appropriate level of cooperation between the authorities supervising those other sandboxes and the national supervisory authorities. 5. Data protection regulatory sandboxes established under this Article shall provide for a controlled environment that fosters innovation and facilitates the development, testing and validation of innovative data processing for a limited time before processing of personal data takes place pursuant to a specific sandbox plan agreed between the controller and the supervisory authority, ensuring that appropriate safeguards are in place. 6. Supervisory authorities shall provide, as appropriate, guidance, supervision and support within the data protection regulatory sandbox with a view to identifying risks, in particular to fundamental rights, health and safety, testing, mitigation measures, and their effectiveness in relation to the obligations and requirements of this Regulation and, where relevant, other Union and national law supervised within the sandbox. 7. Supervisory authorities shall provide controllers participating in the data protection regulatory sandbox with guidance on regulatory expectations and how to fulfil the requirements and obligations set out in this Regulation. Upon request of the controller, the supervisory authority shall provide a written proof of the activities successfully carried out in the sandbox. The supervisory authority shall also provide an exit report detailing the activities carried out in the sandbox and the related results and learning outcomes 8. If the controller and the national supervisory authority explicitly agree, the exit report may be made publicly available through the single information platform referred to in this Article. 9. The establishment of data protection regulatory sandboxes shall aim to contribute to the following objectives: a. improving legal certainty to achieve regulatory compliance with this Regulation or, where relevant, other applicable Union and national law; b. supporting the sharing of best practices through cooperation with the authorities involved in the data protection regulatory sandbox; c. fostering innovation and competitiveness and facilitating the development of a data protection ecosystem; d. contributing to evidence-based regulatory learning; e. facilitating and accelerating access to the Union market for technical developments, in particular when provided by SMEs, including start-ups, and SMCs. 10. Where the technical developments constitute AI systems, the competent national authorities shall additionally ensure that the national market surveillance authorities within the meaning of Article 3, point (26), of Regulation (EU) 2024/1689 are involved in the operation of the data protection regulatory sandbox to the extent of their respective tasks and powers. 11. The data protection regulatory sandboxes shall not affect the supervisory or corrective powers of the competent authorities supervising the sandboxes, including at regional or local level. Any significant risks to health and safety and fundamental rights identified during the development and testing of such technical developments shall result in an adequate mitigation. National competent authorities shall have the power to temporarily or permanently suspend the testing process, or the participation in the sandbox if no effective mitigation is possible, and shall inform the EDPB of such decision. National competent authorities shall exercise their supervisory powers within the limits of the relevant law, using their discretionary powers when implementing legal provisions in respect of a specific data protection regulatory sandbox project, with the objective of supporting innovation in data protection in the Union. 12. Controllers participating in the data protection regulatory sandbox shall remain liable under applicable Union and national liability law for any damage inflicted on third parties as a result of the experimentation taking place in the sandbox. However, provided that the controllers observe the specific plan and the terms and conditions for their participation and follow in good faith the guidance given by the national supervisory authority, no administrative fines shall be imposed by the authorities for infringements of this Regulation. Where other competent authorities responsible for other Union and national law were actively involved in the supervision of the data processing in the sandbox and provided guidance for compliance, no administrative fines shall be imposed regarding that law. 13. The data protection regulatory sandboxes shall be designed and implemented in such a way that, where relevant, they facilitate cross-border cooperation between national supervisory authorities. 14. National supervisory authorities, the EDPS and the Commission shall, as appropriate and within their respective competences, coordinate their activities and cooperate within the framework of the EDPB. They may support the joint establishment and operation of data protection regulatory sandboxes, including in different sectors and exchange best practices on related matters. 15. National supervisory authorities shall inform the EDPB of the establishment of a sandbox. The EDPB shall make publicly available a list of planned and existing sandboxes and keep it up to date in order to encourage more interaction in the data protection regulatory sandboxes and cross-border cooperation. 16. National supervisory authorities shall submit annual reports to the EDPB and the Commission, from one year after the establishment of the data protection regulatory sandbox and every year thereafter until its termination, and a final report. Those reports shall provide information on the progress and results of the implementation of those sandboxes, including best practices, incidents, lessons learnt and recommendations on their setup and, where relevant, on the application and possible revision of this Regulation, including its delegated and implementing acts, and on the application of other Union law supervised by the competent authorities within the sandbox. The national supervisory authorities shall make those annual reports or abstracts thereof available to the public, online. The Commission shall, where appropriate, take the annual reports into account when exercising its tasks under this Regulation. 17. The Commission shall develop a single and dedicated interface containing all relevant information related to data protection regulatory sandboxes to allow stakeholders to interact with data protection regulatory sandboxes and to raise enquiries with supervisory authorities, and to seek non-binding guidance on the conformity of innovative products, services, business models embedding data protection technologies. The Commission shall proactively coordinate with national supervisory authorities, where relevant. Article 88f Detailed arrangements for, and functioning of, data protection regulatory sandboxes 1. In order to avoid fragmentation across the Union, the EDPB shall establish and make public a framework specifying the detailed arrangements for the establishment, development, implementation, operation, governance, and supervision of the data protection regulatory sandboxes. The framework shall include common principles on the following issues: a. eligibility and selection criteria for participation in the data protection regulatory sandbox; b. procedures for the application, participation, monitoring, exiting from and termination of the data protection regulatory sandbox, including the sandbox plan and the exit report; c. the terms and conditions applicable to the participants; d. the detailed rules applicable to the governance of data protection regulatory sandboxes covered under Article 88x, including the coordination and cooperation at national and EU level. 2. The framework referred to in paragraph 1 shall ensure: a. that data protection regulatory sandboxes are open to any applying controller of a technical developments who fulfils eligibility and selection criteria, which shall be transparent and fair, and that national supervisory authorities inform applicants of their decision within three months of the application; b. that data protection regulatory sandboxes allow broad and equal access and keep up with demand for participation; controllers may also submit applications in partnerships with other controllers and other relevant third parties; c. that the detailed arrangements for, and conditions concerning data protection regulatory sandboxes support, to the best extent possible, flexibility for national supervisory authorities to establish and operate their data protection regulatory sandboxes; d. that access to the data protection regulatory sandboxes is free of charge for SMEs, including start-ups, without prejudice to exceptional costs that national supervisory authorities may recover in a fair and proportionate manner; e. that data protection regulatory sandboxes facilitate the involvement of other relevant actors within the data protection ecosystem, such as SMEs, including start-ups, enterprises, innovators, testing and experimentation facilities, research and experimentation labs and European Digital Innovation Hubs, centres of excellence, individual researchers, in order to allow and facilitate cooperation with the public and private sectors; f. that procedures, processes and administrative requirements for application, selection, participation and exiting the data protection regulatory sandbox are simple, easily intelligible, and clearly communicated in order to facilitate the participation of SMEs, including start-ups, with limited legal and administrative capacities and are streamlined across the Union, in order to avoid fragmentation and that participation in an data protection regulatory sandbox established by a Member State, or by the European Data Protection Supervisor is mutually and uniformly recognised and carries the same legal effects across the Union; g. that participation in the data protection regulatory sandbox is limited to a period that is appropriate to the complexity and scale of the project and that may be extended by the national supervisory authority; h. that data protection regulatory sandboxes facilitate the development of tools and infrastructure for testing, benchmarking, assessing and explaining dimensions of data processing relevant for regulatory learning, such as accuracy, data minimisation and security of processing as well as measures to mitigate risks to fundamental rights and society at large. Article 88g Further processing of personal data for developing certain technical developments data processing in the public interest in the data protection regulatory sandbox 1. In the data protection regulatory sandbox, personal data lawfully collected for other purposes may be processed solely for the purpose of developing and testing certain technical developments in the sandbox when all of the following conditions are met: a. Technical developments shall be developed for safeguarding substantial public interest by a public authority or another natural or legal person and in one or more of the following areas: i. public safety and public health, including disease detection, diagnosis prevention, control and treatment and improvement of health care systems; ii. a high level of protection and improvement of the quality of the environment, protection of biodiversity, protection against pollution, green transition measures, climate change mitigation and adaptation measures; iii. energy sustainability; iv. safety and resilience of transport systems and mobility, critical infrastructure and networks; v. efficiency and quality of public administration and public services; vi. the protection of the data subject or the rights and freedoms of others; b. the data processed are necessary for complying with one or more of the requirements referred to in Articles 25, 32 or 35 where those requirements cannot effectively be fulfilled by processing anonymised, synthetic or other non-personal data; c. there are effective monitoring mechanisms to identify if any high risks to the rights and freedoms of the data subjects, as referred to in Article 35, may arise during the sandbox experimentation, as well as response mechanisms to promptly mitigate those risks and, where necessary, stop the processing; d. any personal data to be processed in the context of the sandbox are in a functionally separate, isolated and protected data processing environment under the responsibility of the controller and only authorised persons have access to those data; e. controllers can further share the originally collected data only in accordance with Union data protection law; any personal data created in the sandbox cannot be shared outside the sandbox; f. any processing of personal data in the context of the sandbox does not leads to measures or decisions affecting the data subjects; g. any personal data processed in the context of the sandbox are protected by means of appropriate technical and organisational measures and deleted once the participation in the sandbox has terminated or the personal data has reached the end of its retention period; h. the logs of the processing of personal data in the context of the sandbox are kept for the duration of the participation in the sandbox, unless provided otherwise by Union or national law; i. a complete and detailed description of the process and rationale behind the testing and validation of the data processing is kept together with the testing results; j. a short summary of the data processing project developed in the sandbox, its objectives and expected results is published on the website of the supervisory authorities; this obligation shall not cover sensitive operational data in relation to the activities of law enforcement, border control, immigration or asylum authorities. 2. To the processing of personal data carried out within an data protection regulatory sandbox, provided that the processing takes place exclusively within the Union and it is ensured that authorities or other bodies of third countries cannot gain access to the processed data, only Article 5(1), point (f), in conjunction with paragraph 2, Article 24 and Article 32 shall apply, in addition to Chapters I, X and XI. For the processing of personal data carried out within a data protection regulatory sandbox, and provided that the processing takes place exclusively within the Union and that access to the processed data by authorities or other bodies of third countries is prevented, Member States shall provide for derogations from or exemptions to Chapter II (Principles), Chapter III (Rights of the data subject), Chapter IV (Controller and processor), Chapter V (Transfers of personal data to third countries or international organisations), Chapter VI (Independent supervisory authorities), Chapter VII (Cooperation and consistency) and Chapter IX (Provisions relating to specific processing situations) where this is necessary to reconcile the right to the protection of personal data with the objective of fostering innovation and strengthening the competitiveness of the Union. 3. Paragraph 1 is without prejudice to Union or national law which excludes processing of personal data for other purposes than those explicitly mentioned in that law, as well as to Union or national law laying down the basis for the processing of personal data which is necessary for the purpose of developing, testing of innovative processing operations or any other legal basis, in compliance with Union law on the protection of personal data.'Justification
Data protection sandboxes make GDPR compliance more predictable for innovative processing, PETs and AI use cases. Building on the AI Act model, they provide controlled testing, supervisory guidance, exit reports, cross-border learning and SME access. No-fine protection applies only where participants follow the agreed plan in good faith; authorities keep corrective powers, liability remains, high risks must be mitigated and public-interest further processing is subject to strict safeguards.
noyb's comment:
While the support and oversight by the supervisory authority envisioned by this proposal would help participants of the sandbox implement new processing activities, the very broad exemptions from the GDPR would almost certainly result in a reduction of the level of data protection. At the same time the very complex set of rules governing the sandboxes and allowing for a number of different interpretations and implementations by member states and authorities does not seem likely to result in any simplification.
#1721 Article 5 – paragraph 3 (Article 5 – paragraph 1 – point 2 – introductory part)
Authored by
Directive 2002/58/EC
Article 5 – paragraph 3
Text proposed by the Commission
2. After Article 5(3), the following subparagraph is added:Amendment
2. Article 5(3) is deleted.Justification
The AM removes overlapping ePrivacy rules on security, terminal access, metadata, location data and direct marketing where personal-data processing is already governed by the GDPR. Keeping parallel regimes creates consent fatigue, divergent national transpositions and legal uncertainty, including stricter rules for some anonymous device data than for personal data. Consolidation under the GDPR’s risk-based framework simplifies compliance, strengthens coherent rights exercise, supports innovation and preserves sector-specific rules in dedicated instruments.
noyb's comment:
Removes the ePrivacy protection. The GDPR currently does not provide for the same protection.
#1730 Article 5 – paragraph 3 – subparagraph 2 (new) (Article 5 – paragraph 1 – point 2)
Authored by
Directive 2002/58/EC
Article 5 – paragraph 3 – subparagraph 2 (new)
Text proposed by the Commission
This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data.Amendment
The processing of personal data previously governed by these provisions shall be exclusively subject to Regulation (EU) 2016/679. (It applies to overall directive.)Justification
The AM removes overlapping ePrivacy rules on security, terminal access, metadata, location data and direct marketing where personal-data processing is already governed by the GDPR. Keeping parallel regimes creates consent fatigue, divergent national transpositions and legal uncertainty, including stricter rules for some anonymous device data than for personal data. Consolidation under the GDPR’s risk-based framework simplifies compliance, strengthens coherent rights exercise, supports innovation and preserves sector-specific rules in dedicated instruments.
noyb's comment:
Removes ePrivacy Protection and is limited to personal data, while the ePrivacy Protectin offered broader protection.
#1732 Article 6 (Article 5 – paragraph 1 – point 2 a (new))
Authored by
Directive 2002/58/EC
Article 6
Text proposed by the Commission
Amendment
2a. Article 6 is deleted.Justification
The AM removes overlapping ePrivacy rules on security, terminal access, metadata, location data and direct marketing where personal-data processing is already governed by the GDPR. Keeping parallel regimes creates consent fatigue, divergent national transpositions and legal uncertainty, including stricter rules for some anonymous device data than for personal data. Consolidation under the GDPR’s risk-based framework simplifies compliance, strengthens coherent rights exercise, supports innovation and preserves sector-specific rules in dedicated instruments.
#1733 Article 9 (Article 5 – paragraph 1 – point 2 b (new))
Authored by
Directive 2002/58/EC
Article 9
Text proposed by the Commission
Amendment
2b. Article 9 is deleted.Justification
The AM removes overlapping ePrivacy rules on security, terminal access, metadata, location data and direct marketing where personal-data processing is already governed by the GDPR. Keeping parallel regimes creates consent fatigue, divergent national transpositions and legal uncertainty, including stricter rules for some anonymous device data than for personal data. Consolidation under the GDPR’s risk-based framework simplifies compliance, strengthens coherent rights exercise, supports innovation and preserves sector-specific rules in dedicated instruments.
#1735 Article 13 (Article 5 – paragraph 1 – point 2 c (new))
Authored by
Directive 2002/58/EC
Article 13
Text proposed by the Commission
Amendment
2c. Article 13 is deleted.Justification
The AM removes overlapping ePrivacy rules on security, terminal access, metadata, location data and direct marketing where personal-data processing is already governed by the GDPR. Keeping parallel regimes creates consent fatigue, divergent national transpositions and legal uncertainty, including stricter rules for some anonymous device data than for personal data. Consolidation under the GDPR’s risk-based framework simplifies compliance, strengthens coherent rights exercise, supports innovation and preserves sector-specific rules in dedicated instruments.