Lena Düpont

Text proposed by the Commission

Amendment

(32a) The possibility of drawing conclusions regarding a data subject's health status through the combination, analysis or contextual interpretation of other data should not, in itself, result in the classification of such data as data concerning health for the purposes of Article 9. Data should only fall within the special category referred to in Article 9(1) where it directly and inherently discloses information concerning health, and not merely because such information could, in principle, be derived from it by a third party through further processing, enrichment or analysis.

noyb's comment:

The amendment restrains the scope of the definition in Article 9.

#310 Recital 33 a (new)

Authored by

Text proposed by the Commission

Amendment

(33a) To ensure legal certainty and support the responsible development and use of artificial intelligence in the Union, it should be clarified that processing of personal data in the context of development, deployment, training, testing, operation and improvement of AI systems or models, including related products and services, may constitute a lawful ground under this Regulation where the conditions laid down in Article 9(2), point (k), are met.

noyb's comment:

The amendment goes further than the Commission's proposal.

#321 Recital 34

Authored by

Text proposed by the Commission

(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. The notion of biometric data includes two distinct functions, namely the identification of a natural person or the verification (also called authentication) of his or her claimed identity, both of which rely on different technical processes. The identification process is based on a ‘one-to-many’ search of the data subject’s biometric data in a database, while the verification process is based on a ‘one-to-one’ comparison of biometric data provided by the data subject, who is thereby claiming his or her identity. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should also be allowed where the verification of the claimed identity of the data subject is necessary for a purpose pursued by the controller, and suitable safeguards apply to enable the data subject to have sole control of the verification process. For example, where the biometric data are securely stored solely at the side of the data subject or are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, that processing is not likely to create significant risks to his or her fundamental rights and freedoms. The controller does not gain knowledge of the biometric data or only for a very limited time during the verification process.

Amendment

(34) Biometric data, as defined in Article 4(14) of Regulation (EU) 2016/679, means processing of certain characteristics of a natural person through a specific technical means and which allows or confirms the unique identification of that person. Derogating from the prohibition to process biometric data under Article 9(1) of the Regulation should be allowed where the data subject is offered a non-biometric alternative and suitable safeguards are implemented to ensure fundamental rights of the data subject are adequately protected through the implementation of the necessary safeguards. For example, where the biometric data are securely stored solely by the device the side of the data subject, or the biometric data is are securely stored at the side of the controller in a state-of-the-art encrypted form and the encryption key or equivalent means is held solely by the data subject, and subject to measures ensuring the overall security of the processing, including during the enrolment phase of data subject and at the time when the data subject agrees to share the biometric data or encryption key. Other examples of appropriate safeguards are ensuring that end-to-end encryption, or similar state of the art technology, is used when data are transmitted over a communication channel and providing data subjects with the possibility to securely erase their biometric data in accordance with Article 17 of Regulation (EU) 2016/679.

noyb's comment:

The amendment almost goes back to a consent requirement, like under the current text, and includes an obligation to provide a less intrusive alternative.

#347 Recital 36 a (new)

Authored by

Text proposed by the Commission

Amendment

(36a) To reduce administrative burdens for civil-society and volunteer-based organisations, associations and non-profit entities should not be subject to the full scope of the regulation and in particular not of information and record-keeping obligations of Regulation 2016/679, provided their data processing is limited to low-risk internal administrative purposes and does not involve systematic monitoring or high-risk operations. Member States should ensure that such entities can fulfil transparency obligations through general public information rather than individual notices

noyb's comment:

Reducing the scope for certain organisations simplifies GDPR compliance for those organisations while reducing the level of data protection. E.g. certain data subjects would not be informed about the processing of their data.

#396 Recital 41

Authored by

Lena Düpont

Oliver Schenk

Text proposed by the Commission

(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council¹⁶ applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council¹⁷ applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brough into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. _________________ ¹⁶ Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). ¹⁷ Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).

Amendment

(41) Regulation (EU) 2018/1725 of the European Parliament and of the Council¹⁶ applies to the processing of personal data by the Union institutions, bodies, offices and agencies. Directive (EU) 2016/680 of the European Parliament and of the Council¹⁷ applies to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regulation (EU) 2018/1725 and Directive (EU) 2016/680 should be brough into alignment with the amendments to Regulation (EU) 2016/679 introduced by this Regulation. Any alignment brought to Directive (EU) 2016/680 by the amendments to Regulation (EU) 2016/679 shall not override the legitimate national and public security interests of Member States, as well as the legitimate internal security interests of the Union. _________________ ¹⁶ Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). ¹⁷ Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).

noyb's comment:

No real direct effect but just accounting for differences in LED and GDPR.

#401 Recital 43

Authored by

Lena Düpont

Oliver Schenk

Text proposed by the Commission

Amendment

(43) In order to provide a strong and coherent data protection framework in the Union, the necessary adaptations of Directive (EU) 2016/680 and any other Union legal act applicable to such processing of personal data should follow after the adoption of this regulation, in order to allow for their application as close as possible to the entry into application of the amendments to Regulation (EU) 2016/679 and Regulation (EU) 2018/1725. Any following adaption of Directive (EU) 2016/680 should not impair the ability of competent authorities to process personal data collected in the context of the prevention, investigation, detection or prosecution of specific criminal offences in order to develop an understanding of criminal activities and to make links between different criminal offences detected. Moreover, any concurrent adaptation of Regulation (EU) 2018/1725 shall not impair the processing of personal data for the purpose of preventing threats to public security, internal security of Union institutions and bodies, or other important objectives of general public interest of the Union or of a Member State, in particular the objectives of the Common Foreign and Security Policy of the Union or an important economic or financial interest of the Union or of a Member State.

noyb's comment:

This proposal seems to signal that a general superiority of processing related to law enforcement over data protection. In particular regarding the aspects of “understanding of criminal activities and to make links between different criminal offences detected” which might refer to big data analysis based on criminal data, this seems like pushing for a reduction of the level of privacy.

#467 Recital 46

Authored by

Text proposed by the Commission

(46) Data subjects should have the possibility to rely on automated and machine-readable indications of their choice to consent or refuse a consent request or object to the processing of data. Such means should follow the state of the art. They can be implemented in the settings of a web browser or in the EU Digital Identity Wallet as set out by Regulation (EU) 914/2014, or any other adequate means. Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces. The controller should be obliged to respect automated and machine-readable indications of data subject’s choices once there are available standards. In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, media service providers should not be obliged to respect the machine-readable indications of data subject’s choices. The obligation for providers of web browsers to provide the technical means for data subjects to make choices with respect to the processing should not undermine the possibility for media service providers to request consent by data subjects.

Amendment

noyb's comment:

Goes back beyond the Commission proposal. Tries to grant legislative powers to Media Service Providers?!

#943 Article 4 – point 1 – second part (Article 3 – paragraph 1 – point 1 – point a)

Authored by

Regulation (EU) 2016/679
Article 4 – point 1 – second part

Text proposed by the Commission

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

Amendment

Information relating to a natural person, is not personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. That assessment shall take into account objective factors, including but not limited to costs, time, available technology and the legal means available to that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

noyb's comment:

The amendment does not materially change the Commission's proposal, thus overall remains a decrease of protection compared to the current Article 4(1).

#948 Article 4 – point 15 (Article 3 – paragraph 1 – point 1 – point a)

Authored by

Regulation (EU) 2016/679
Article 4 – point 15

Text proposed by the Commission

Amendment

(15) ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status; Data that merely allow such information to be inferred indirectly shall not be considered data concerning health;

noyb's comment:

Lowering the protections for health data (e.g. person buying HIV medicine would not be covered anymore under Article 9 because the person could buy it for someone else).

#953 Article 4 – point 33 (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 33

Text proposed by the Commission

(33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply;

Amendment

(33) electronic communications networks’ means transmission systems as defined in of Article 2(1) of Directive (EU) 2018/1972;

#971 Article 4 – point 38 (Article 3 – paragraph 1 – point 1 – point b)

Authored by

Regulation (EU) 2016/679
Article 4 – point 38

Text proposed by the Commission

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.

Amendment

(38) “scientific research” means creative and systematic work undertaken in order to increase the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts without any particular application or use in view, or through original investigation undertaken in order to acquire new knowledge directed primarily towards a specific, practical aim or objective. This does not exclude that the research may also aim to further a commercial interest.

noyb's comment:

like amendment 970

#1045 Article 9 – paragraph 1 (Article 3 – paragraph 1 – point 3 – point a a (new))

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 1

Text proposed by the Commission

Amendment

(aa) Paragraph 1 of Article 9 is replaced by the following: Processing of personal data that directly reveals in relation to a specific data subject racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health relating to the physical or mental health status of a natural person, or data concerning a natural person's sex life or sexual orientation shall be prohibited.

noyb's comment:

Limitation of scope of Article 9 to information that only "directly" reveals such data.

#1057 Article 9 – paragraph 5 (Article 3 – paragraph 1 – point 3 – point b)

Authored by

Regulation (EU) 2016/679
Article 9 – paragraph 5

Text proposed by the Commission

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

Amendment

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented, in accordance with Article 89 safeguards to limit the processing of special categories of personal data and to mitigate the risk associated with the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall ensure that such data are processed under one or more of the conditions referred to in paragraph 2, points a to j, or remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’

noyb's comment:

The amendment proposes to have a "fall-back" Article 9(2) legal basis for residual special categories of personal data which is a wider allowance than initially proposed by the Commission.

#1112 Article 13 – paragraph 4 (Article 3 – paragraph 1 – point 5)

Authored by

Regulation (EU) 2026/679
Article 13 – paragraph 4

Text proposed by the Commission

4. Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.

Amendment

4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information or where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35.’

noyb's comment:

Small amendments to the Commission's proposal. Mainly clarififying that the proposal provides for an additional exemption. A lack of information typcially violates the "fairness" principle in Article 8(2) of the Charter.

#1123 Article 13 – paragraph 5 (Article 3 – paragraph 1 – point 6)

Authored by

Regulation (EU) 2016/679
Article 13 – paragraph 5

Text proposed by the Commission

5. When the processing takes place for scientific research purposes and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.

Amendment

5. When the processing takes place for scientific research purposes, including scientific research in the public interest aiming to further a commercial interest, and the provision of information referred to under paragraphs 1, 2 and 3 proves impossible or would involve a disproportionate effort, including cases where the change of purpose could not have been anticipated at the time of collection, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing, the controller does not need to provide the information referred to under paragraphs 1, 2 and 3. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available. This scenario shall apply equally to the obligations under Article 14(5)(b).

noyb's comment:

This proposal builds upon the Commission's proposal, but even decreases the level of privacy in those cases. It may violate the purpose limitation and fairness principle in Article 8(2) of the Charter.

#1128 Article 13 – paragraph 4a (new) (Article 3 – paragraph 1 – point 6 a (new))

Authored by

Regulation (EU) 2016/679
Article 13 – paragraph 4a (new)

Present text

Article 13 Information to be provided where personal data are collected from the data subject 1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: (a) the identity and the contact details of the controller and, where applicable, of the controller's representative; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; (e) the recipients or categories of recipients of the personal data, if any; (f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available. 2. In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability; (c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (d) the right to lodge a complaint with a supervisory authority; (e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; (f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. 3. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2. 4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.

Amendment

6a. In Article 13, paragraph 4a is added: "Paragraphs 1 to 4 shall not apply to associations, foundations, and other non-profit organisations established in the Union, provided that: (a) the processing of personal data is limited to the administration of membership, volunteers, donors, or beneficiaries; (b) such processing is not likely to result in a high risk to the rights and freedoms of natural persons; and (c) the data are not shared with third parties for commercial purposes."

Justification

Article 13 information obligations are essential for transparency, but they can create disproportionate administrative burdens for small non-profit organisations where the processing relationship is clear, direct and limited to internal administrative purposes. Associations, foundations and other non-profit organisations should therefore be allowed to fulfil transparency obligations through publicly accessible information where processing is limited to members, volunteers, donors or beneficiaries, does not involve systematic monitoring, is not likely to result in a high risk and is not used for commercial third-party sharing. This targeted clarification supports civic engagement and volunteer work while preserving the substance of the right to information.

noyb's comment:

This proposal adds an exemption from the information obligation similar to the Commission's proposal but limited in its scope. Unlike the Commission's proposal, this version is much clearer and the added legal uncertainty is probably lower than the administrative simplification. Such a broad ecemption of information duties likely violates the "fairness" principle in Article 8(2) of the Charter.

#1192 Article 33 – paragraph 6 (Article 3 – paragraph 1 – point 8 – point c)

Authored by

Regulation (EU) 2016/679
Article 33 – paragraph 6

Text proposed by the Commission

6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

Amendment

6. The Board shall establish and make public common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person and a list of the circumstances in which it is not likely to result in such a high risk.. The template and lists shall be available to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2). 7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6.’

noyb's comment:

This amendment, in particular, follows some considerations of the EDPB/EDPS opinion and adds the creation of a white-list the documents the Board shall establish, providing increased legal certainty.

#1209 Article 35 – paragraph 4 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 4

Text proposed by the Commission

4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

Amendment

4. The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

noyb's comment:

Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.

#1214 Article 35 – paragraph 5 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 5

Text proposed by the Commission

5. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.

Amendment

5. Processing operations not covered by the list in paragraph 4 shall not be subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

noyb's comment:

This template would reduce factually reduce the cases in which a controller would prepare a DPIA, resulting in a lower level of data protection but less administrative work for controllers.

#1217 Article 35 – paragraph 6 (Article 3 – paragraph 1 – point 9 – point a)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 6

Text proposed by the Commission

6. The Board shall prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments.

Amendment

6. The Board shall establish a common template and a common methodology for conducting data protection impact assessments.

noyb's comment:

Following the considerations of the EDPB/EDPS opinion this proposal shifts competences to the EDPB. No significant effect on the level of privacy or simplification.

#1224 Article 35 – paragraph 6a (Article 3 – paragraph 1 – point 9 – point b)

Authored by

Regulation (EU) 2016/679
Article 35 – paragraph 6a

Text proposed by the Commission

6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

Amendment

6a. The proposal for the list referred to in paragraph 4 and for the template and methodology referred to in paragraph within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2). That list shall be based on convergence area from national authorities and shall not introduce new categories of processing operations that go beyond existing obligations under this Regulation. Processing operations lawfully in place at the time of their initiation shall not be subject to a retroactive obligation to carry out a data protection impact assessment as a result of the adoption of the harmonised list.

noyb's comment:

This proposal (apparently subject to editorial mistakes) tries to narrow the scope of potential processing activities subject to a DPIA; therefore, it lowers the level of data protection. It also introduces some legal uncertainty, offsetting a potential reduction in administrative workload.

#1254 Article 41a – paragraph 1 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 1

Text proposed by the Commission

(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.

Amendment

(1) The Commission may adopt implementing acts to specify technical and organisational measures and criteria supporting controllers in assessing whether data resulting from anonymisation or pseudonymisation no longer constitutes personal data for certain entities and in preventing the risk of re-identification.

noyb's comment:

The amendment improves the Commission's proposal but remains a decrease of protection compared to the current Article 4(1) and 4(6).

#1269 Article 41a – paragraph 2 – point a (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a

Text proposed by the Commission

(a) assess the state of the art of available techniques;

Amendment

(a) assess the state of the art of available techniques, such as privacy- enhancing technologies;

noyb's comment:

Does not bring material change in regards to the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.

#1275 Article 41a – paragraph 2 – point b (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b

Text proposed by the Commission

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.

Amendment

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data, taking into account objective factors such as cost, amount of time required, available technology, legal obligations.

noyb's comment:

#1281 Article 41a – paragraph 2 – point ba (new) (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 2 – point ba (new)

Text proposed by the Commission

Amendment

(ba) In Article 41a, paragraph 2, the following point ba is added: '(ba) assess technical, administrative, organisational and contractual measures that can prevent the risk of re-identification.'

noyb's comment:

Does not add anything material towards the Commission's proposal. The proposal stays overall as a decrease of protection for data subjects' fundamental rights. Such decisions are typcially reserved to SAs under Article 8(3) of the Charter.

#1289 Article 41a – paragraph 3 (Article 3 – paragraph 1 – point 10)

Authored by

Regulation (EU) 2016/679
Article 41a – paragraph 3

Text proposed by the Commission

(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.

Amendment

(3) The implementation of the technical and organisational measures and criteria outlined in an implementing act may be used as an element to demonstrate that pseudonymised data do not lead to reidentification of the data subjects in a specific case.

noyb's comment:

#1312 Article 57 – paragraph 1 – point aa (new) (Article 3 – paragraph 1 – point 11 – point a a (new))

Authored by

Regulation (EU) 2016/679
Article 57 – paragraph 1 – point aa (new)

Text proposed by the Commission

Amendment

(aa) In Article 57, paragraph 1, the following point aa is inserted: '(aa) handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80 and investigate, in the case of a complaint by a data subject at its discretion, to the extent approriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisor authority is necessary;'

noyb's comment:

The amendment gives more discretion to supervisory authorities, which could lead to less complaint handling. The lack of a remedy (beyond civil courts) could violate Article 8(3) and 47 of the Charter.

#1314 Article 57 – paragraph 1 – va (Article 3 – paragraph 1 – point 11 – point a b (new))

Authored by

Regulation (EU) 2016/679
Article 57 – paragraph 1 – va

Text proposed by the Commission

Amendment

(ab) In Article 57, paragraph 1, the following point va is added: '(va) set up regulatory sandboxes to facilitate testing the compliance of specific techniques or technological solutions to be used for the data processing activities with the obligations under this Regulation or whether the data processing results in data that would be exempt from this Regulation.'

noyb's comment:

The amendment provides for compliance tools to be put in place by the supervisory authorities, ultimately shifting compliance to them. The fact that a full excemption from the Regulation is granted would undermine the rights under the GDPR.

#1326 Article 70 – paragraph 1 – point ha (Article 3 – paragraph 1 – point 14)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point ha

Text proposed by the Commission

Amendment

(ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment, pursuant to Article 35.

noyb's comment:

On its own, this amendment has no significant impact. Clear lists simplify the application of the law.

#1331 Article 70 – paragraph 1 – point hb (Article 3 – paragraph 1 – point 14)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hb

Text proposed by the Commission

(hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

Amendment

(hb) establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

noyb's comment:

This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.

#1336 Article 70 – paragraph 1 – point hc (Article 3 – paragraph 1 – point 14)

Authored by

Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc

Text proposed by the Commission

(hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

Amendment

(hc) establish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

noyb's comment:

This amendment seems to follow some considerations of the EDPB/EDPS opinion and the shift of competences to the EDPB. Clear templates simplify the application of the law.

#1394 Article 88a – paragraph 3 – point c (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c

Text proposed by the Commission

(c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use;

Amendment

(c) (c) creating information about the usage of an online service to measure the audience of such a service, where it is carried out at the direction of the controller of that online service, or by a third party acting on behalf of the controller;

noyb's comment:

Broadens the new exception proposed.

#1405 Article 88a – paragraph 3 – point da (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)

Text proposed by the Commission

Amendment

(da) In Article 88a, paragraph 3, the following point da is added: '(da) ‘legitimate interests’ according to Article 6(1)(f) of this regulation provided that the controller applies Privacy Enhancing Technologies (PETs) in accordance with the technical standards adopted pursuant to Article 25a. This point shall not apply to processing operations that involve tracking or profiling a data subject's behaviour for the purposes of behavioural advertising, where the advertising itself is directly generating revenue for the controller, or where there is no direct relationship with the data subject.'

noyb's comment:

New exception introduced. Very vague, mixing different concepts (personal data, legitimate interest and PETs).

#1412 Article 88a – paragraph 3 – point db (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 3 – point db (new)

Text proposed by the Commission

Amendment

(db) In Article 88a, paragraph 3, the following point db is added: '(db) performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083.'

noyb's comment:

New exception proposed.

#1427 Article 88a – paragraph 4 – point a (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4 – point a

Text proposed by the Commission

(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means;

Amendment

(a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner, or be presented with the option to decline consent and proceed to a paid alternative; 

noyb's comment:

Makes the refusal of consent dependent on a payment.

#1436 Article 88a – paragraph 4 – point c (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c

Text proposed by the Commission

(c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months.

Amendment

(c) Where data subject refuse request for consent presented by media service providers, Media service providers shall be able to offer data subjects an equivalent alternative that is not accompanied by the processing of personal data for audience-based advertising purposes, where appropriate for a reasonable fee.

noyb's comment:

Limits the proposal of the Commission to media service providers and rewrites it to introduce payment for refusing consent, but is unclear about the details. Questionable from an equality before the law perspective.

#1455 Article 88b – title (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – title

Text proposed by the Commission

Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

Amendment

Voluntary automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons

noyb's comment:

Significantly weakens the positive Commission proposal. A voluntary system would be chaotic and hardly functioning (see "DNT").

#1550 Article 88b – paragraph 7a (new) (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88b – paragraph 7a (new)

Text proposed by the Commission

Amendment

(7a) In Article 88b, the following paragrpah is added: '7a. The Commission shall, by [insert date = 3 years after the date of entry into force of this Regulation], submit a report to the European Parliament and the Council on the functioning of this Article, including an assessment of: (a) the impact on user choice and competition; (b) the effectiveness of machine-readable indications in reducing consent fatigue; (c) the emergence of new gatekeeper risks; (d) the impact on European media service providers; and (e) the need for legislative amendment.'

noyb's comment:

Reporting duties of the Commission.

#1561 Article 88c – paragraph 1 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 1

Text proposed by the Commission

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Amendment

Where the processing of personal data is necessary for the interests of the controller, or a third party, in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, including a general-purpose AI model as defined in Article 3, point (63) of Regulation (E) 2024/1689, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of this Regulation except where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child and except where other Union explicitly require consent. The processing of personal data in the context of the development and operation of an AI system may also be based for the performance of a task carried out by public authorities in the public interest pursuant to Article 6, paragraph 1, point (e) and paragraph 2.

noyb's comment:

The amendment rephrases the Commission's proposal.

#1587 Article 88c – paragraph 2 (Article 3 – paragraph 1 – point 15)

Authored by

Regulation (EU) 2016/679
Article 88c – paragraph 2

Text proposed by the Commission

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.

Amendment

Any such processing shall be subject to appropriate organisational, technical and legal measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects.

noyb's comment:

The amendment pushes against the right to object in proposed Article 88c.

#1599 Article 14 – paragraph 5a (new) (Article 3 – paragraph 1 a (new))

Authored by

Regulation (EU) 2016/679
Article 14 – paragraph 5a (new)

Present text

Article 14 Information to be provided where personal data have not been obtained from the data subject 1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information: (a) the identity and the contact details of the controller and, where applicable, of the controller's representative; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) the categories of personal data concerned; (e) the recipients or categories of recipients of the personal data, if any; (f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available. 2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; (c) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability; (d) where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (e) the right to lodge a complaint with a supervisory authority; (f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources; (g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. The controller shall provide the information referred to in para graphs 1 and 2: (a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circum stances in which the personal data are processed; (b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or (c) if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed. 4. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2. 5. Paragraphs 1 to 4 shall not apply where and insofar as: (a) the data subject already has the information; (b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available; (c) obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject's legitimate interests; or (d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.

Amendment

In Article 14, paragraph 5a is added: "'5a. Where the controller is an association, foundation, or other non-profit organisation, and the personal data have not been obtained from the data subject, paragraphs 1 to 5 shall not apply where providing the information would require a disproportionate effort and the processing is limited to the internal purposes described in Article 13(6). In such cases, the controller shall adopt appropriate transparency measures.'"

Justification

Non-profit organisations may receive personal data indirectly in the context of volunteer coordination, beneficiary support, charitable activities or membership-related administration. In such situations, providing individual information notices to each data subject can require disproportionate effort, particularly for small or volunteer-based organisations. This amendment allows proportionate transparency measures, such as public notices or online publication, where the processing remains limited to low-risk internal purposes. It preserves transparency while avoiding unnecessary bureaucracy for civil-society organisations.

noyb's comment:

The amendment includes a derogation which is not foreseen in the current regime.

#1600 Article 30 – paragraph 5a (new) (Article 3 – paragraph 1 b (new))

Authored by

Regulation (EU) 2016/679
Article 30 – paragraph 5a (new)

Present text

Article 30 Records of processing activities 1. Each controller and, where applicable, the controller's represen tative, shall maintain a record of processing activities under its respon sibility. That record shall contain all of the following information: (a) the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer; (b) the purposes of the processing; (c) a description of the categories of data subjects and of the categories of personal data; (d) the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or inter national organisations; (e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the docu mentation of suitable safeguards; (f) where possible, the envisaged time limits for erasure of the different categories of data; (g) where possible, a general description of the technical and organisa tional security measures referred to in Article 32(1). 2. Each processor and, where applicable, the processor's representa tive shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing: (a) the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller's or the processor's represen tative, and the data protection officer; (b) the categories of processing carried out on behalf of each controller; (c) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the docu mentation of suitable safeguards; B (d) where possible, a general description of the technical and organisa tional security measures referred to in Article 32(1). 3. The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form. 4. The controller or the processor and, where applicable, the controller's or the processor's representative, shall make the record available to the supervisory authority on request. 5. The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.

Amendment

In Article 30, paragraph 5a is added "'5a. Paragraphs 1-4 shall not apply to associations, foundations, and other non-profit organisations whose processing activities are limited to the purposes described in Article 13(6).'"

Justification

Record-keeping obligations under Article 30 should be proportionate to the actual risk of the processing activity. Small non-profit organisations, associations and foundations often lack dedicated compliance structures and process data only for limited internal administrative purposes. Requiring full records of processing activities in such low-risk cases creates administrative burdens without a corresponding benefit for data subjects. This amendment clarifies that the exemption applies to non-profit organisations where processing is limited to the purposes set out in Article 13(6), while preserving the full obligation where processing is likely to result in a high risk to the rights and freedoms of data subjects.

noyb's comment:

While this amendment aims to add a new paragraph, it – apparently incorrectly – shows a deletion of the existing Article 30(1) GDPR. Not taking this into account, the reduction of the scope of Article 30 for certain organisations would – for them – reduce their administrative workload.

#1601 Article 2 – paragraph 2 – point e (new) (Article 3 – paragraph 1 c (new))

Authored by

Regulation (EU) 2016/679
Article 2 – paragraph 2 – point e (new)

Present text

2. This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity;

Amendment

In Article 2, the following point e is added: "'(e) by associations, foundations and other non-profit organisations established in the Union, where the processing is carried out solely in the course of their statutory non-commercial activities and is limited to the administration of members, former members, volunteers, donors or beneficiaries, provided that such processing does not involve systematic monitoring or processing likely to result in a high risk to the rights and freedoms of natural persons within the meaning of Article 35, and that the personal data are not disclosed to third parties for commercial purposes.'"

Justification

Associations, foundations and other non-profit organisations generally process personal data within clear, direct and non-commercial relationships with their members, volunteers, donors or beneficiaries. Subjecting such limited and low-risk processing to the full scope of Regulation (EU) 2016/679 places a disproportionate administrative burden on civil-society and volunteer-based organisations, many of which lack dedicated compliance structures. This targeted exclusion complements the specific simplifications proposed for Articles 13, 14 and 30, while preserving the application of the Regulation to systematic monitoring, automated decision-making, high-risk processing and the commercial disclosure of personal data.

noyb's comment:

The amendment reduces protection by limiting the scope of the GDPR but with that simplifying compliance for the affected controllers. At the same time cooperation with controllers covered by the GDPR will likely be more complicated.