Monika Hohlmeier

Text proposed by the Commission

Amendment

(32a) The possibility of drawing conclusions regarding a data subject's health status through the combination, analysis or contextual interpretation of other data should not, in itself, result in the classification of such data as data concerning health for the purposes of Article 9. Data should only fall within the special category referred to in Article 9(1) where it directly and inherently discloses information concerning health, and not merely because such information could, in principle, be derived from it by a third party through further processing, enrichment or analysis.

noyb's comment:

The amendment restrains the scope of the definition in Article 9.

#310 Recital 33 a (new)

Authored by

Text proposed by the Commission

Amendment

(33a) To ensure legal certainty and support the responsible development and use of artificial intelligence in the Union, it should be clarified that processing of personal data in the context of development, deployment, training, testing, operation and improvement of AI systems or models, including related products and services, may constitute a lawful ground under this Regulation where the conditions laid down in Article 9(2), point (k), are met.

noyb's comment:

The amendment goes further than the Commission's proposal.

#943 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)

Authored by

Regulation (EU) 2016/679
Article 4 – point 1 – second part

Text proposed by the Commission

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

Amendment

Information relating to a natural person, is not personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. That assessment shall take into account objective factors, including but not limited to costs, time, available technology and the legal means available to that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

noyb's comment:

The amendment does not materially change the Commission's proposal, thus overall remains a decrease of protection compared to the current Article 4(1).

#948 Article 4 – point 15 (Article 3 – paragraph 1 – point 1 – point a)

Authored by

Regulation (EU) 2016/679
Article 4 – point 15

Text proposed by the Commission

Amendment

(15) ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status; Data that merely allow such information to be inferred indirectly shall not be considered data concerning health;

noyb's comment:

Lowering the protections for health data (e.g. person buying HIV medicine would not be covered anymore under Article 9 because the person could buy it for someone else).

#953 Article 4 – point 33 (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 33

Text proposed by the Commission

(33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply;

Amendment

(33) electronic communications networks’ means transmission systems as defined in of Article 2(1) of Directive (EU) 2018/1972;

#971 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 38

Text proposed by the Commission

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.

Amendment

(38) “scientific research” means creative and systematic work undertaken in order to increase the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts without any particular application or use in view, or through original investigation undertaken in order to acquire new knowledge directed primarily towards a specific, practical aim or objective. This does not exclude that the research may also aim to further a commercial interest.

noyb's comment:

like amendment 970

#1003 Article 5 – paragraph 3a (new) (Article 3 – paragraph 1 – point 2 a (new))

Authored by

Regulation (EU) 2026/679
Article 5 – paragraph 3a (new)

Text proposed by the Commission

Amendment

2a. In Article 5, the following paragraph 3 is added: '3a. The principles and obligations laid down in this Regulation shall be applied and interpreted in a manner that is commensurate with the objective pursued by the provision concerned, that restricts the free movement of personal data no further than is necessary, and that gives due weight to the interests and to the fundamental rights and freedoms of persons other than the data subject.'

noyb's comment:

The amendment includes a balancing test in favour of less privacy.

#1008 Article 6 – paragraph 4 – subparagraph (new) (Article 3 – paragraph 1 – point 2 b (new))

Authored by

Regulation (EU) 2016/679
Article 6 – paragraph 4 – subparagraph (new)

Text proposed by the Commission

Amendment

2b. In Article 6, paragraph 4, the following sentence is added: 'Where the intended further processing is compatible with the purposes for which the personal data were initially collected, it may rest on the legal basis that justified their collection; a separate legal basis shall not be required.'

noyb's comment:

Violates the need for a legal basis in Article 8(2) of the Charter. Consent for one purpose could be used for secondard processing for another purpose.

#1042 Article 9 – paragraph 2 – point la (new) (Article 3 – paragraph 1 – point 3 – point a)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 2 – point la (new)

Text proposed by the Commission

Amendment

(la) In Article 9, paragraph 2, the following point is inserted. the other points should be adapted accordingly. '(la) the processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of precontractual measures taken at the data subject’s request;'

noyb's comment:

The amendment includes more derogations than the Commission's proposal.

#1045 Article 9 – paragraph 1 (Article 3 – paragraph 1 – point 3 – point a a (new))

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 1

Text proposed by the Commission

Amendment

(aa) Paragraph 1 of Article 9 is replaced by the following: Processing of personal data that directly reveals in relation to a specific data subject racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health relating to the physical or mental health status of a natural person, or data concerning a natural person's sex life or sexual orientation shall be prohibited.

noyb's comment:

Limitation of scope of Article 9 to information that only "directly" reveals such data.

#1057 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 5

Text proposed by the Commission

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

Amendment

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented, in accordance with Article 89 safeguards to limit the processing of special categories of personal data and to mitigate the risk associated with the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall ensure that such data are processed under one or more of the conditions referred to in paragraph 2, points a to j, or remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’

noyb's comment:

The amendment proposes to have a "fall-back" Article 9(2) legal basis for residual special categories of personal data which is a wider allowance than initially proposed by the Commission.

#1098 Article 12 – paragraph 8a (new) (Article 3 – paragraph 1 – point 4 a (new))

Authored by

Regulation (EU) 2016/679
Article 12 – paragraph 8a (new)

Text proposed by the Commission

Amendment

4a. In Article 12, the following paragraph 8a is added: '8a. Where the controller is a SME, the obligations arising under this Chapter and the documentation duties connected with them shall apply in a manner proportionate to the size of the enterprise, the nature of the processing and the risk it presents for data subjects. The Board shall issue guidelines setting out simplified means of compliance for such enterprises.'

noyb's comment:

The amendment restricts all obligation under chapter 3 for SMEs (99% of all EU businesses), which could be beneficial for documentation duties but could restrict data subject rights. SMEs can include large data brokers and alike. The actual meaning of this provision is unclear, hence the simplification is unclear.

#1123 Article 13 – paragraph 5 (Article 3 – paragraph 1 – point 6)

Authored by

Regulation (EU) 2016/679
Article 13 – paragraph 5

Text proposed by the Commission

5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.

Amendment

5. When the processing takes place for scientific research purposes, including scientific research in the public interest aiming to further a commercial interest, and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort, including cases where the change of purpose could not have been anticipated at the time of collection, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available. This scenario shall apply equally to the obligations under Article 14(5)(b).

noyb's comment:

This proposal builds upon the Commission's proposal, but even decreases the level of privacy in those cases. It may violate the purpose limitation and fairness principle in Article 8(2) of the Charter.

#1133 Article 15 – paragraph 3 (Article 3 – paragraph 1 – point 6 a (new))

Authored by

Regulation (EU) 2016/679
Article 15 – paragraph 3

Text proposed by the Commission

Amendment

6a. Article 15, paragraph 3 is amended as follows: 3. The controller shall provide the data subject with a copy of the personal data undergoing processing; that copy shall be confined to the personal data as such.

noyb's comment:

The amendment restricts the right to access.

#1137 Article 15 – paragraph 4 (Article 3 – paragraph 1 – point 6 b (new))

Authored by

Regulation (EU) 2016/679
Article 15 – paragraph 4

Text proposed by the Commission

Amendment

6b. Article 15, paragraph 4 is amended as follows: 4. The right of access referred to in paragraphs 1 and 2 and the right to obtain a copy referred to in paragraph 3 shall not affect the rights and freedoms of other persons, including the controller. Paragraph 3 shall not apply if and to the extent that the provision of the copy proves impossible or would require a disproportionate effort.

noyb's comment:

The amendment restricts the right to access and highlights a balancing test in favour of less privacy. Such a broad exemption likely violates the "access" element in Article 8(2) of the Charter.

#1192 Article 33 – paragraph 6 (Article 3 – paragraph 1 – point 8 – point c)

Authored by

Regulation (EU) 2016/679
Article 33 – paragraph 6

Text proposed by the Commission

6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

Amendment

6. The Board shall establish and make public common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person and a list of the circumstances in which it is not likely to result in such a high risk.. The template and lists shall be available to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2). 7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6.’

noyb's comment:

This amendment, in particular, follows some considerations of the EDPB/EDPS opinion and adds the creation of a white-list the documents the Board shall establish, providing increased legal certainty.

#1201 Article 34 – paragraph 2 (Article 3 – paragraph 1 – point 8 a (new))

Authored by

Regulation (EU) 2016/679
Article 34 – paragraph 2

Text proposed by the Commission

Amendment

8a. Article 34, paragraph 2 is amended as follows: 2. The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in points (b), (c) and (d) of Article 33(3) and, where possible, the categories of personal data records concerned.

noyb's comment:

This proposal adds the categories of personal data records concerned to the information required under Article 34(2), providing data subjects with more information. Since the controller already needs to have this information, the added administrative work in adding this information to the communication is insignificant.

#1209 Article 35 – paragraph 4 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 4

Text proposed by the Commission

4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

Amendment

4. The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

noyb's comment:

Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.

#1214 Article 35 – paragraph 5 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 5

Text proposed by the Commission

5. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.

Amendment

5. Processing operations not covered by the list in paragraph 4 shall not be subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

noyb's comment:

This template would reduce factually reduce the cases in which a controller would prepare a DPIA, resulting in a lower level of data protection but less administrative work for controllers.

#1217 Article 35 – paragraph 6 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 6

Text proposed by the Commission

6. The Board shall prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments.

Amendment

6. The Board shall establish a common template and a common methodology for conducting data protection impact assessments.

noyb's comment:

Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.

#1224 Article 35 – paragraph 6a (Article 3 – paragraph 1 – point 9 – point b)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 6a

Text proposed by the Commission

6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

Amendment

6a. The proposal for the list referred to in paragraph 4 and for the template and methodology referred to in paragraph within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2). That list shall be based on convergence area from national authorities and shall not introduce new categories of processing operations that go beyond existing obligations under this Regulation. Processing operations lawfully in place at the time of their initiation shall not be subject to a retroactive obligation to carry out a data protection impact assessment as a result of the adoption of the harmonised list.

noyb's comment:

This proposal (apparently subject to editorial mistakes) tries to narrow the scope of potential processing activities subject to a DPIA; therefore, it lowers the level of data protection. It also introduces some legal uncertainty, offsetting a potential reduction in administrative workload.

#1237 Article 37 – paragraph 7 (Article 3 – paragraph 1 – point 9 a (new))

Authored by

Regulation (EU) 2016/679
Article 37 – paragraph 7

Text proposed by the Commission

Amendment

9a. Article 37, paragraph 7, is amended as follows: The controller or the processor shall publish the contact details of the data protection officer.

noyb's comment:

This proposal gets rid of the controllers or processors obligation to communicate the contact details of the DPO to the supervisory authority. Therefore, this takes away the DPA’s option to check whether a DPO is appointed or draw up statistics like how many DPA’s are appointed in a single year. Similarly, in case of a complaint against a controller, the supervisory authority could see whether the controller has / had a DPO at the time of the violation. However, getting rid of the reporting obligation reduces complexity for controllers.

#1254 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 1

Text proposed by the Commission

(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.

Amendment

(1) The Commission may adopt implementing acts to specify technical and organisational measures and criteria supporting controllers in assessing whether data resulting from anonymisation or pseudonymisation no longer constitutes personal data for certain entities and in preventing the risk of re-identification.

noyb's comment:

The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1) and 4(6).

#1269 Article 41a – paragraph 2 – point a (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a

Text proposed by the Commission

(a) assess the state of the art of available techniques;

Amendment

(a) assess the state of the art of available techniques, such as privacy- enhancing technologies;

noyb's comment:

Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.

#1275 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b

Text proposed by the Commission

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.

Amendment

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data, taking into account objective factors such as cost, amount of time required, available technology, legal obligations.

noyb's comment:

#1281 Article 41a – paragraph 2 – point ba (new) (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 2 – point ba (new)

Text proposed by the Commission

Amendment

(ba) In Article 41a, paragraph 2, the following point ba is added: '(ba) assess technical, administrative, organisational and contractual measures that can prevent the risk of re-identification.'

noyb's comment:

Does not add anything material towards the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.

#1289 Article 41a – paragraph 3 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 3

Text proposed by the Commission

(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.

Amendment

(3) The implementation of the technical and organisational measures and criteria outlined in an implementing act may be used as an element to demonstrate that pseudonymised data do not lead to reidentification of the data subjects in a specific case.

noyb's comment:

#1312 Article 57 – paragraph 1 – point aa (new) (Article 3 – paragraph 1 – point 11 – point a a (new))

Authored by

Regulation (EU) 2016/679
Article 57 – paragraph 1 – point aa (new)

Text proposed by the Commission

Amendment

(aa) In Article 57, paragraph 1, the following point aa is inserted: '(aa) handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80 and investigate, in the case of a complaint by a data subject at its discretion, to the extent approriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisor authority is necessary;'

noyb's comment:

The amendment gives more discretion to supervisory authorities, which could lead to less complaint handling. The lack of a remedy (beyond civil courts) could violate Article 8(3) and 47 of the Charter.

#1314 Article 57 – paragraph 1 – va (Article 3 – paragraph 1 – point 11 – point a b (new))

Authored by

Regulation (EU) 2016/679
Article 57 – paragraph 1 – va

Text proposed by the Commission

Amendment

(ab) In Article 57, paragraph 1, the following point va is added: '(va) set up regulatory sandboxes to facilitate testing the compliance of specific techniques or technological solutions to be used for the data processing activities with the obligations under this Regulation or whether the data processing results in data that would be exempt from this Regulation.'

noyb's comment:

The amendment provides for compliance tools to be put in place by the supervisory authorities, ultimately shifting compliance to them. The fact that a full excemption from the Regulation is granted would undermine the rights under the GDPR.

#1326 Article 70 – paragraph 1 – point ha (Article 3 – paragraph 1 – point 14)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point ha

Text proposed by the Commission

Amendment

(ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment, pursuant to Article 35.

noyb's comment:

On its own, this amendment has no significant impact. Clear lists simplify the application of the law.

#1331 Article 70 – paragraph 1 – point hb (Article 3 – paragraph 1 – point 14)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hb

Text proposed by the Commission

(hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

Amendment

(hb) establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

noyb's comment:

This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.

#1336 Article 70 – paragraph 1 – point hc (Article 3 – paragraph 1 – point 14)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc

Text proposed by the Commission

(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

Amendment

(hc) establish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

noyb's comment:

This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.

#1390 Article 88a – paragraph 3 – point c (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c

Text proposed by the Commission

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;

Amendment

(c) measuring the audience of an online service in order to draw aggregated information about the usage of an online service to measure the audience of such a service, as defined by article 2 (16) of Regulation 2024/1083, where it is carried out by the controller of that online service solely for its own use or by entitled third parties jointly authorised by advertisers and publishers, solely for the measurement of the overall market performance and subject to the safeguards laid down in Article 89(1);

noyb's comment:

Compared to the current legal framework, a new exception that relies on the Commission proposal, even if more limited that the Commission proposal.

#1420 Article 88a – paragraph 4 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4

Text proposed by the Commission

(4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. This paragraph also applies to the subsequent processing of personal data based on consent.

Amendment

deleted

noyb's comment:

Removes clearer rules on the design of consent requests. Maintains more legal uncertainty.

#1444 Article 88b (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b

Text proposed by the Commission

Article 88b

Amendment

deleted

noyb's comment:

Undoes the positive Commission proposal.

#1453 Article 88b – title (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – title

Text proposed by the Commission

Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

Amendment

deleted

noyb's comment:

Undoes the positive Commission proposal.

#1455 Article 88b – title (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – title

Text proposed by the Commission

Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

Amendment

Voluntary automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

noyb's comment:

Significantly weakens the positive Commission proposal. A voluntary system would be chaotic and hardly functioning (see "DNT").

#1462 Article 88b – paragraph 1 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 1

Text proposed by the Commission

(1) Controllers shall ensure that their online interfaces allow data subjects to: (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.

Amendment

deleted

noyb's comment:

Undoes the positive Commission proposal.

#1468 Article 88b – paragraph 1 – point a (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a

Text proposed by the Commission

(a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled;

Amendment

deleted

noyb's comment:

Removes the main aim of automated signals.

#1488 Article 88b – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 2

Text proposed by the Commission

(2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1.

Amendment

deleted

noyb's comment:

Makes automated signals voluntary.

#1499 Article 88b – paragraph 3 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 3

Text proposed by the Commission

(3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service.

Amendment

deleted

noyb's comment:

Broader application for automated signals, less interruptions for users, unique simpler experience for most interfaces. Exception is questionable from an equality before the law perspective.

#1508 Article 88b – paragraph 4 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 4

Text proposed by the Commission

(4) The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.

Amendment

deleted

noyb's comment:

Removes the standardisation element.

#1526 Article 88b – paragraph 5 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 5

Text proposed by the Commission

(5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation].

Amendment

deleted

noyb's comment:

Can be read as good for privacy (shortening the time for application) or as negative as a part of deleting the article, given that an implementation in 20 days [when the Article would apply] seems too ambitious.

#1532 Article 88b – paragraph 6 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 6

Text proposed by the Commission

(6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article.

Amendment

deleted

noyb's comment:

Limits the commission proposal.

#1542 Article 88b – paragraph 7 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 7

Text proposed by the Commission

(7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation].

Amendment

deleted

noyb's comment:

#1550 Article 88b – paragraph 7a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 7a (new)

Text proposed by the Commission

Amendment

(7a) In Article 88b, the following paragrpah is added: '7a. The Commission shall, by [insert date = 3 years after the date of entry into force of this Regulation], submit a report to the European Parliament and the Council on the functioning of this Article, including an assessment of: (a) the impact on user choice and competition; (b) the effectiveness of machine-readable indications in reducing consent fatigue; (c) the emergence of new gatekeeper risks; (d) the impact on European media service providers; and (e) the need for legislative amendment.'

noyb's comment:

Reporting duties of the Commission.

#1561 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 1

Text proposed by the Commission

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Amendment

Where the processing of personal data is necessary for the interests of the controller, or a third party, in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, including a general-purpose AI model as defined in Article 3, point (63) of Regulation (E) 2024/1689, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of this Regulation except where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child and except where other Union explicitly require consent. The processing of personal data in the context of the development and operation of an AI system may also be based for the performance of a task carried out by public authorities in the public interest pursuant to Article 6, paragraph 1, point (e) and paragraph 2.

noyb's comment:

The amendment rephrases the Commission's proposal.

#1587 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 2

Text proposed by the Commission

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.

Amendment

Any such processing shall be subject to appropriate organisational, technical and legal measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects.

noyb's comment:

The amendment pushes against the right to object in proposed Article 88c.

#1596 Article 2 – paragraph 2 – point da (new) (Article 3 – paragraph 1 – subparagraph 1 (new))

Authored by

Regulation (EU) 2016/679
Article 2 – paragraph 2 – point da (new)

Text proposed by the Commission

Amendment

The following point (da) is added to Article 2(2): '(da) by a natural person in the course of an activity carried out entirely on a voluntary basis, unless that activity involves a type of processing listed pursuant to Article 35(4) GDPR.'

noyb's comment:

The change reduces data protection by narrowing the scope of the GDPR but facilitating complaince for voluntary activities. At the same time cooperation with controllers covered by the GDPR will likely be more complicated.

#1603 Article 80 (Article 3 a (new))

Authored by

Regulation (EU) 2016/679
Article 80

Present text

Article 80 Representation of data subjects 1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.

Amendment

Article 3 a (new) Article 80 is deleted. ""

noyb's comment:

The amendment removes the right for data subjects to mandate a representative.