amendment list, 27 July 2026
Amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework, and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus)
Document CJ72-AM-791072 · (COM(2025)0837 – 2025/0360(COD))
Committee on Industry, Research and Energy Committee on Civil Liberties, Justice and Home Affairs
Full text
Jump to an amendment (276)
- Amendment 777
- Amendment 778
- Amendment 779
- Amendment 780
- Amendment 781
- Amendment 782
- Amendment 783
- Amendment 784
- Amendment 785
- Amendment 786
- Amendment 787
- Amendment 788
- Amendment 789
- Amendment 790
- Amendment 791
- Amendment 792
- Amendment 793
- Amendment 794
- Amendment 795
- Amendment 796
- Amendment 797
- Amendment 798
- Amendment 799
- Amendment 800
- Amendment 801
- Amendment 802
- Amendment 803
- Amendment 804
- Amendment 805
- Amendment 806
- Amendment 807
- Amendment 808
- Amendment 809
- Amendment 810
- Amendment 811
- Amendment 812
- Amendment 813
- Amendment 814
- Amendment 815
- Amendment 816
- Amendment 817
- Amendment 818
- Amendment 819
- Amendment 820
- Amendment 821
- Amendment 822
- Amendment 823
- Amendment 824
- Amendment 825
- Amendment 826
- Amendment 827
- Amendment 828
- Amendment 829
- Amendment 830
- Amendment 831
- Amendment 832
- Amendment 833
- Amendment 834
- Amendment 835
- Amendment 836
- Amendment 837
- Amendment 838
- Amendment 839
- Amendment 840
- Amendment 841
- Amendment 842
- Amendment 843
- Amendment 844
- Amendment 845
- Amendment 846
- Amendment 847
- Amendment 848
- Amendment 849
- Amendment 850
- Amendment 851
- Amendment 852
- Amendment 853
- Amendment 854
- Amendment 855
- Amendment 856
- Amendment 857
- Amendment 858
- Amendment 859
- Amendment 860
- Amendment 861
- Amendment 862
- Amendment 863
- Amendment 864
- Amendment 865
- Amendment 866
- Amendment 867
- Amendment 868
- Amendment 869
- Amendment 870
- Amendment 871
- Amendment 872
- Amendment 873
- Amendment 874
- Amendment 875
- Amendment 876
- Amendment 877
- Amendment 878
- Amendment 879
- Amendment 880
- Amendment 881
- Amendment 882
- Amendment 883
- Amendment 884
- Amendment 885
- Amendment 886
- Amendment 887
- Amendment 888
- Amendment 889
- Amendment 890
- Amendment 891
- Amendment 892
- Amendment 893
- Amendment 894
- Amendment 895
- Amendment 896
- Amendment 897
- Amendment 898
- Amendment 899
- Amendment 900
- Amendment 901
- Amendment 902
- Amendment 903
- Amendment 904
- Amendment 905
- Amendment 906
- Amendment 907
- Amendment 908
- Amendment 909
- Amendment 910
- Amendment 911
- Amendment 912
- Amendment 913
- Amendment 914
- Amendment 915
- Amendment 916
- Amendment 917
- Amendment 918
- Amendment 919
- Amendment 920
- Amendment 921
- Amendment 922
- Amendment 923
- Amendment 924
- Amendment 925
- Amendment 926
- Amendment 927
- Amendment 928
- Amendment 929
- Amendment 930
- Amendment 931
- Amendment 932
- Amendment 933
- Amendment 934
- Amendment 935
- Amendment 936
- Amendment 937
- Amendment 938
- Amendment 939
- Amendment 940
- Amendment 941
- Amendment 942
- Amendment 943
- Amendment 944
- Amendment 945
- Amendment 946
- Amendment 947
- Amendment 948
- Amendment 949
- Amendment 950
- Amendment 951
- Amendment 952
- Amendment 953
- Amendment 954
- Amendment 955
- Amendment 956
- Amendment 957
- Amendment 958
- Amendment 959
- Amendment 960
- Amendment 961
- Amendment 962
- Amendment 963
- Amendment 964
- Amendment 965
- Amendment 966
- Amendment 967
- Amendment 968
- Amendment 969
- Amendment 970
- Amendment 971
- Amendment 972
- Amendment 973
- Amendment 974
- Amendment 975
- Amendment 976
- Amendment 977
- Amendment 978
- Amendment 979
- Amendment 980
- Amendment 981
- Amendment 982
- Amendment 983
- Amendment 984
- Amendment 985
- Amendment 986
- Amendment 987
- Amendment 988
- Amendment 989
- Amendment 990
- Amendment 991
- Amendment 992
- Amendment 993
- Amendment 994
- Amendment 995
- Amendment 996
- Amendment 997
- Amendment 998
- Amendment 999
- Amendment 1000
- Amendment 1001
- Amendment 1002
- Amendment 1003
- Amendment 1004
- Amendment 1005
- Amendment 1006
- Amendment 1007
- Amendment 1008
- Amendment 1009
- Amendment 1010
- Amendment 1011
- Amendment 1012
- Amendment 1013
- Amendment 1014
- Amendment 1015
- Amendment 1016
- Amendment 1017
- Amendment 1018
- Amendment 1019
- Amendment 1020
- Amendment 1021
- Amendment 1022
- Amendment 1023
- Amendment 1024
- Amendment 1025
- Amendment 1026
- Amendment 1027
- Amendment 1028
- Amendment 1029
- Amendment 1030
- Amendment 1031
- Amendment 1032
- Amendment 1033
- Amendment 1034
- Amendment 1035
- Amendment 1036
- Amendment 1037
- Amendment 1038
- Amendment 1039
- Amendment 1040
- Amendment 1041
- Amendment 1042
- Amendment 1043
- Amendment 1044
- Amendment 1045
- Amendment 1046
- Amendment 1047
- Amendment 1048
- Amendment 1049
- Amendment 1050
- Amendment 1051
- Amendment 1052
Text 2,394 paragraphs
Amendment 777
Michael McNamara, Irena Joveva, Sophie Wilmès, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32g – paragraph 1a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1a) In Article 32g, the following paragraph is inserted: | |
| '1a. The competent authorities referred to in Article 32b may, upon a request by a natural or legal person, monitor and supervise whether recognised data intermediation services providers and recognised data altruism organisations comply with the requirements laid down in this Chapter, including whether they continue to comply with the requirements for registration laid down therein.' |
Or. en
Amendment 778
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Read the rest (2,382 paragraphs)
Regulation (EU) 2023/2854
Article 32g – paragraph 5 – subparagraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) be removed from the public Union register referred to in Article 32a. | (b) be removed from the public registers referred to in Article 32a. |
Or. pt
Amendment 779
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32g – paragraph 5 – point ba (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ba) In Article 32g, paragraph 5, the following point is added: | |
| '(ba) be subject to a proportionate and dissuasive sanction, in accordance with Article 40 of this Regulation.' |
Or. en
Amendment 780
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32g – paragraph 5 – point ba (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (bb) In Article 32g, paragraph 5, the following point is added: | |
| '(ba) suspend its activities.' |
Or. en
Amendment 781
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32g – paragraph 5 – subparagraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| Any decision revoking the right to use the label as referred to in the first subparagraph, point (a), shall be made public by the competent authority. | Any decision revoking the right to use the label as referred to in the first subparagraph, point (a), shall be made public by the competent authority shall be notified to the Commission. The Commission shall remove the entity from the public Union register. |
Or. en
Amendment 782
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Chapter VIIb
| Text proposed by the Commission | Amendment |
|---|---|
| ‘CHAPTER VIIb | deleted |
Or. pt
Amendment 783
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Chapter VIIb
| Text proposed by the Commission | Amendment |
|---|---|
| Free flow of non-personal data in the Union’ | deleted |
Or. pt
Amendment 784
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32h
| Text proposed by the Commission | Amendment |
|---|---|
| ‘Article 32h | deleted |
Or. pt
Amendment 785
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32ga (new)
| Text proposed by the Commission | Amendment |
|---|---|
| After Article 32g, the following Article is inserted: | |
| 'Article 32ga | |
| Mandatory complaint handling | |
| A recognised data intermediation services provider or a recognised data altruism organisation shall set up an easily accesible system by which data subjects or data holders can lodge complaints for infringements on the requirements laid down in this Chapter. The recognised data intermediation services provider or a recognised data altruism organisation will have 7 days to confirm the receipt of this complaint and 21 days to provide a reasoned response to the data subjects or data holder that lodged the complaint.' |
Or. en
Amendment 786
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32h
| Text proposed by the Commission | Amendment |
|---|---|
| Prohibition of localisation requirements for non-personal data within the Union | deleted |
Or. pt
Amendment 787
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32h – title
| Text proposed by the Commission | Amendment |
|---|---|
| Prohibition of localisation requirements for non-personal data within the Union | Conditions for localisation requirements relating to non-personal data within the Union |
Or. en
Amendment 788
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32h – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Data localisation requirements for non-personal data shall be prohibited, unless they are justified on grounds of public security in compliance with the principle of proportionality or laid down on the basis of Union law. | deleted |
Or. pt
Amendment 789
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32h – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Data localisation requirements for non-personal data shall be prohibited, unless they are justified on grounds of public security in compliance with the principle of proportionality or laid down on the basis of Union law. | (1) Data localisation requirements for non-personal data may be imposed where they are justified on grounds of public security, the resilience and continuity of essential services, an overriding legitimate interest, or the protection of national and economic security. |
Or. en
Justification
The location of non-personal data has become a factor of resilience, strategic autonomy and economic security. Rather than treating data localisation requirements as prohibited in principle, this amendment establishes a modulable framework under which such requirements may be imposed where they are justified on defined grounds — public security, the resilience and continuity of essential services, an overriding legitimate interest, or the protection of national and economic security — or laid down on the basis of Union law. This effect-based approach enables Member States and the Union to address dependency and disruption risks affecting data of strategic importance, while the requirement that any such measure be necessary and proportionate to the objective pursued preserves the coherence of the internal market and the compatibility of the framework with the Union's international commitments.
Amendment 790
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32h – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Member States shall immediately communicate to the Commission any draft act which introduces a new data localisation requirement or makes changes to an existing data localisation requirement in accordance with the procedures set out in Articles 5, 6 and 7 of Directive (EU) 2015/1535 of the European Parliament and of the Council.’ | deleted |
Or. pt
Amendment 791
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32h – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Member States shall immediately communicate to the Commission any draft act which introduces a new data localisation requirement or makes changes to an existing data localisation requirement in accordance with the procedures set out in Articles 5, 6 and 7 of Directive (EU) 2015/1535 of the European Parliament and of the Council.’ | (2) Member States shall communicate to the Commission any draft act which introduces a new data localisation requirement or makes changes to an existing data localisation requirement in accordance with the procedures set out in Articles 5, 6 and 7 of Directive (EU) 2015/1535 of the European Parliament and of the Council.’ |
Or. en
Amendment 792
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32ia (new)
| Text proposed by the Commission | Amendment |
|---|---|
| After Article 32i, the following Article is inserted: | |
| 'Article 32ia | |
| Reinforcing openness and predictability in public sector data re-use | |
| 1. Within the categories of data covered by this Chapter, public sector bodies shall apply a presumption in favour of re-use, subject to the exceptions and protections already provided for under this Chapter, Union law, or national law. This paragraph does not create an obligation to grant unconditional access to data, nor a legal basis for processing personal data, and is without prejudice to Regulation (EU) 2016/679. | |
| 2. Where technically and legally feasible and proportionate to the resources available to the public sector body concerned, newly created or substantially upgraded information systems shall be designed to support the automated publication of data as open data by default under an "open by design" principle . Member States may issue guidance to support implementation of this principle by smaller or resource-constrained public sector bodies. | |
| 3. The single information points shall maintain and publicly disclose an indicative rolling overview of dataset categories expected to become available for re-use within the following 24 months. This obligation shall apply at the level of the single information point, to simplify the reporting burdens. | |
| 4. Member States shall ensure that public sector bodies publish and regularly update a list of datasets held by them that are not made available for re-use, or are subject to restricted access, together with a summary of the grounds for such restriction, unless such publication would itself compromise the ground for restriction. | |
| 5. Any natural or legal person may request the single information point to collect, generate or structure an open dataset. The single information point shall identify the correct public body which shall assess the request within a reasonable time and implement the request or provide reasons where it declines to act on it. | |
| 6. Public sector bodies shall use standard open licences as provided for under this Chapter. Custom or restricted access terms, including the differentiated conditions and fees when explicitly permitted, shall remain available under the conditions set out in that Article. | |
| 7. Datasets deemed suitable for publication shall be made available for re-use without undue delay. Single information points shall report periodically, in accordance with implementing acts adopted by the Commission on average publication timelines within their jurisdiction, to support monitoring and benchmarking.' |
Or. en
Amendment 793
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32i – paragraph 1a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1a) In Article 32i, the following paragraph is inserted: | |
| '1a. Public sector bodies allowing the re-use of data and documents under this Chapter shall apply appropriate technical and organisational measures to prevent the re-identification of pseudonymised data, personal data breaches, and any unlawful acquisition, use, disclosure or transfer of the data. Where the data are made available in pseudonymised or anonymised form, state-of-the-art privacy-preserving and privacy-enhancing techniques shall be applied to that effect. Data and documents relating to natural persons, or protected by trade secrets or by a legal obligation of confidentiality relating to legal persons, shall be made available for re-use only where they have been anonymised or, where anonymisation is not possible, subject to appropriate safeguards, including such techniques and binding conditions on the re-user preventing any re-identification or misuse.' |
Or. en
Justification
Public sector bodies allowing the re-use of data must apply appropriate technical and organisational measures. The amendment requires reliance on state-of-the-art privacy-preserving techniques — anonymisation, pseudonymisation, aggregation, disclosure control, encryption, secure processing environments — proportionate to the nature of the data and the level of risk, so as to enable broad re-use while maintaining a high level of protection.
Amendment 794
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32i – paragraph 1a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1a) In Article 32i, the following paragraph is inserted: | |
| '1a. This Regulation does not create any obligation on public sector bodies to allow the re-use of data, nor does it release public sector bodies from their confidentiality obligations under Union or national law.' |
Or. en
Amendment 795
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32i – paragraph 1(a) (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1a) This Regulation does not create any obligation on public sector bodies to allow the re-use of data, nor does it release public sector bodies from their confidentiality obligations under Union or national law. |
Or. en
Amendment 796
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32i – paragraph 1b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1b) In Article 32i, the following paragraph is inserted: | |
| '1b. A public sector body that has allowed the re-use of data and documents in accordance with this Chapter, and that has applied the measures referred to in paragraph 11, shall not be held liable for any unlawful use, re-identification, disclosure or onward transfer of the data carried out by the re-user or by any third party to whom the re-user has made the data available. The re-user shall ensure that its re-use of the data, and any onward transfer of the data, complies with this Chapter and with Union and national law, including Regulation (EU) 2016/679. The re-user shall be liable for any misuse, unlawful re-identification or unauthorised transfer of the data carried out by it or by such third parties. This paragraph is without prejudice to the liability of the public sector body for a failure to comply with its own obligations under this Chapter.' |
Or. en
Amendment 797
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32i –paragraph 1(b) new
| Text proposed by the Commission | Amendment |
|---|---|
| (1b) In Article 32i, the following paragraph is inserted: | |
| '1b. This Regulation does not create a legal basis for the processing of personal data, nor does it affect any of the rights and obligations set out in Regulation (EU) 2016/679.' |
Or. en
Amendment 798
Mary Khan
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32i – paragraph 2 – subparagraph d a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (da) In Article 32i(2), the following subparagraph is added: | |
| ‘(da) data and documents of the armed forces, intelligence services, police and law enforcement authorities, public prosecutors’ offices and courts, tax and customs authorities, health and social services authorities, population registers, migration and asylum authorities, as well as data of minors, biometric or genetic data and communication data, unless their re-use is explicitly allowed by a specific national law;’ |
Or. de
Amendment 799
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32i – paragraph 1 – point aa (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (aa) In article 32i, paragraph 1, the following point is inserted: | |
| 'aa. data or documents whose disclosure would reveal trade secrets within the meaning of Directive (EU) 2016/943, or information otherwise protected by a legal obligation of confidentiality relating to legal persons.' |
Or. en
Amendment 800
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32i – paragraph 3 – point ga (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ga) In Article 32i, paragraph 3, the following point is added: | |
| 'ga. data or documents containing personal data relating to the health, tax or financial situation, residence, or civil status of natural persons, as well as personal data covered by a legal or professional obligation of confidentiality, in particular medical confidentiality or the confidentiality of judicial decisions, the re-use of which is liable to harm the rights and freedoms of the persons concerned or to enable their identification.' |
Or. en
Amendment 801
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32i – paragraph 9a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (9a) In Article 32i, the following paragraph is inserted: | |
| '9a. This Chapter shall not create a legal basis or obligation for the processing, disclosure, access to, or re-use of personal data. Nothing in this Chapter shall be interpreted as limiting the rights of data subjects or the obligations of controllers and processors under Regulations (EU) 2016/679 and (EU) 2018/1725.' |
Or. en
Amendment 802
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32i – paragraph 9b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (9b) In Article 32i, the following paragraph is added: | |
| '9b. In the case of mixed datasets, Regulation (EU) 2016/679 applies. Personal data shall not be made available for re-use unless a valid legal basis exists under that Regulation and appropriate safeguards are applied.' |
Or. en
Amendment 803
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32j – paragraph 2a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| In Article 32j, the following paragraph is added: | |
| '2a. The re-use of data and documents under this Chapter shall not entail their transfer to, or access by, a third-country authority or a natural or legal person established in a third country where such transfer or access would be liable to harm public security, the resilience and continuity of essential services, or the national and economic security of the Union or of a Member State.' |
Or. en
Justification
Prohibits the re-identification of data subjects from anonymised datasets, the unlawful use of such data, and their transfer to entities reasonably likely to be able to re-identify the data subjects. Without such a prohibition, the anonymisation regime would be devoid of any sanction for its circumvention. The prohibition does not preclude research into anonymisation techniques carried out in accordance with Regulation (EU) 2016/679.
Amendment 804
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32j – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Any applicable conditions for the re-use of data or documents shall be non-discriminatory, transparent, proportionate and objectively justified with regard to the categories of data or documents and the purposes of re-use and the nature of the data or documents for which re-use is allowed. Those conditions shall not be used to restrict competition. This principle shall equally apply for comparable categories of re-use, including for cross-border re-use. | (1) Any applicable conditions for the re-use of data or documents shall be non-discriminatory, transparent, proportionate and objectively justified with regard to the categories of data or documents and the purposes of re-use and the nature of the data or documents for which re-use is allowed. |
Or. pt
Amendment 805
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32j – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) If data or documents are re-used by a public sector body as input for its commercial activities which fall outside the scope of its public tasks, the same charges and other conditions shall apply to the supply of the data or documents for those activities as the ones that apply to other re-users. | deleted |
Or. pt
Amendment 806
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32k – paragraph 2 – point da (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (da) In Article 32k, paragraph 2, the following point is added: | |
| 'sa. the exclusive right shall not be granted to an entity established in a third country, or to an entity established in the Union that is under the direct or indirect control of a third-country entity, where the grant would be liable to expose the data concerned to the extraterritorial application of a third-country law or to harm the defence, security or economic security of the Union or of a Member State; before granting the right, the public sector body shall assess these risks, including any restrictive technical specifications liable to result in such exposure or dependency.' |
Or. en
Amendment 807
Dario Tamburrano
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32k – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) By way of derogation of paragraph 1, where an exclusive right relates to the digitisation of cultural resources, the period of exclusivity shall in general not exceed 10 years. Where that period exceeds 10 years, its duration shall be in accordance with applicable Union and national law subject to review during the 11th year and, if applicable, every seven years thereafter. | (3) By way of derogation from paragraph 1, where an exclusive right relates to the digitisation of cultural resources, the total period of exclusivity, including any renewal, extension or successive arrangement having the same or an equivalent effect, shall not exceed 10 years. Where the beneficiary of the exclusive right is an undertaking designated as a gatekeeper pursuant to Article 3(1) of Regulation (EU) 2022/1925, that total period shall not exceed five years. Digitised cultural resources that are in the public domain shall remain in the public domain after digitisation. Contractual terms, technical measures or access conditions shall not prevent or restrict their lawful re-use after the expiry of the period of exclusivity. |
Or. en
Justification
This amendment establishes an effective maximum duration for exclusive digitisation arrangements and prevents circumvention through renewals, extensions or successive agreements. It also ensures that public-domain cultural resources remain available for lawful re-use once the limited exclusivity period expires.
Amendment 808
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Matthias Ecke, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32k – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) By way of derogation of paragraph 1, where an exclusive right relates to the digitisation of cultural resources, the period of exclusivity shall in general not exceed 10 years. Where that period exceeds 10 years, its duration shall be in accordance with applicable Union and national law subject to review during the 11th year and, if applicable, every seven years thereafter. | (3) By way of derogation of paragraph 1, where an exclusive right relates to the digitisation of cultural resources, the period of exclusivity shall not exceed 10 years, and for very large enterprises, including those undertakings designated as a gatekeeper under Regulation (EU) 2022/1925, 5 years. No renewal or extension shall be permitted unless the public sector body demonstrates that the exclusive right remains strictly necessary, proportionate, and in the public interest. |
| Digitised cultural resources that are in the public domain shall remain in the public domain after digitisation. Contractual terms shall not restrict their re-use beyond the period of exclusivity permitted under paragraph 3. |
Or. en
Justification
This
Amendment 809
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32k – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) By way of derogation of paragraph 1, where an exclusive right relates to the digitisation of cultural resources, the period of exclusivity shall in general not exceed 10 years. Where that period exceeds 10 years, its duration shall be in accordance with applicable Union and national law subject to review during the 11th year and, if applicable, every seven years thereafter. | (3) By way of derogation of paragraph 1, where an exclusive right relates to the digitisation of cultural resources, the period of exclusivity shall in general not exceed 10 years. Where that period exceeds 10 years, its duration shall be in accordance with applicable Union and national law subject to review during the 11th year and, if applicable, every seven years thereafter. The review shall include an assessement of of whether the exclusive right remains strictly necessary, proportionate and in the public interest, and be made publicly available. |
Or. en
Amendment 810
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32k – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) By way of derogation of paragraph 1, where an exclusive right relates to the digitisation of cultural resources, the period of exclusivity shall in general not exceed 10 years. Where that period exceeds 10 years, its duration shall be in accordance with applicable Union and national law subject to review during the 11th year and, if applicable, every seven years thereafter. | (3) By way of derogation of paragraph 1, where an exclusive right relates to the digitisation of cultural resources, the period of exclusivity shall in general not exceed 10 years, or, where the service provider is a gatekeeper, 5 years. Digitised cultural resources that are in the public domain shall remain in the public domain after digitisation. Contractual terms shall not restrict their re-use beyond the period of exclusivity permitted under paragraph 3 of this Article. |
Or. en
Amendment 811
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32k – paragraph 3a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (3a) In Article 32k, the following paragraph is inserted: | |
| '3a. By way of derogation of paragraph 1, where an exclusive right relates to the digitisation of cultural resources, the period of exclusivity for very large enterprises designated as gatekeepers under Article 3(1) of Regulation (EU) 2022/1925 shall not in general exceed five years. Where that period exceeds five years, its duration shall be in accordance with applicable Union and national law subject to review during the 6th year and, if applicable, every three years thereafter. The review shall include an assessement of whether the exclusive right remains strictly necessary, proportionate and in the public interest, and be made publicly available.' |
Or. en
Amendment 812
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32k – paragraph 6a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (6a) In Article 32k, the following paragraph is added: | |
| '6a. Such arrangements shall not have the object or effect of conferring on a single undertaking, in particular a very large undertaking or an undertaking established in or controlled from a third country, a position enabling it to capture the availability of the data for re-use to the detriment of other Union actors. Where such a risk is identified, the public sector body shall give preference to arrangements that preserve access for actors established in the Union and that foster cooperation between Member States.' |
Or. en
Amendment 813
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32l – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Any charges set out under Section 2 or Section 3 shall be transparent, non-discriminatory, proportionate and objectively justified and shall not restrict competition. | (1) Any charges set out under Section 2 or Section 3 shall be transparent, non-discriminatory, proportionate and objectively justified. |
Or. pt
Amendment 814
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32m – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| Public sector bodies shall ensure that applicants for re-use of data or documents are informed of available means of redress relating to decisions or practices affecting them. | Without prejudice to Articles 38 and 39, public sector bodies shall ensure that applicants for re-use of data or documents are informed of available means of redress relating to decisions or practices affecting them. Any decision on re-use shall contain a reference to the means of redress where the applicant wishes to challenge the decision. |
Or. en
Justification
Chapter VIIc on the re-use of public sector data maintains the provisions on redress from the Open Data Directive and the DGA. This amendment clarifies how proposed Articles 32m, 32o(4) and 32ab(2) Data Act relate to proposed Article 38 and current Article 39 Data Act.
Amendment 815
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32n – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Data or documents in scope of this Section shall be re-usable for commercial or non-commercial purposes in accordance with Section 1 and Section 2 Subsection 3. | (1) Data or documents in scope of this Section shall be re-usable in accordance with Section 1 and Section 2 Subsection 3. |
Or. pt
Amendment 816
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32n – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) For data or documents in which libraries, including university libraries, museums and archives hold intellectual property rights and for data or documents held by public undertakings, where the re-use of such data or documents is allowed, those data or documents shall be re-usable for commercial or non-commercial purposes in accordance with Section 1 and Section 2 Subsection 3. | (2) For data or documents in which libraries, including university libraries, museums and archives hold intellectual property rights and for data or documents held by public undertakings, where the re-use of such data or documents is allowed in accordance with national legislation, those data or documents shall be re-usable for commercial or non-commercial purposes in accordance with Section 1 and Section 2 Subsection 3. |
Or. pt
Amendment 817
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32o – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) In the event of a negative decision, the public sector bodies shall communicate the grounds for refusal to the applicant on the basis of the relevant provisions of the access regime in that Member State or the provisions of this Regulation, in particular points (a) to (c) of paragraph 2 of Article 32i and points (a) to (d) of paragraph 3 of Article 32i or Article 32n (general principle ODD Section). Where a negative decision is based on point (d) of paragraph 3 of Article 32i, the public sector body shall include a reference to the natural or legal person who is the rightsholder, where known, or alternatively to the licensor from which the public sector body has obtained the relevant material. Libraries, including university libraries, museums and archives, shall not be required to include such a reference. | (3) In the event of a negative decision, the public sector bodies shall communicate the grounds for refusal to the applicant on the basis of the relevant provisions of the access regime in that Member State or the provisions of this Regulation, in particular points (a) to (c) of paragraph 2 of Article 32i and points (a) to (d) of paragraph 3 of Article 32i, the grounds of public security, defence or economic security referred to in Article 32i(2)(c), or Article 32n (general principle ODD Section). Where a negative decision is based on point (d) of paragraph 3 of Article 32i, the public sector body shall include a reference to the natural or legal person who is the rightsholder, where known, or alternatively to the licensor from which the public sector body has obtained the relevant material. Libraries, including university libraries, museums and archives, shall not be required to include such a reference. |
Or. en
Amendment 818
Mary Khan
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32p – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Member States shall encourage public sector bodies and public undertakings to produce and make available data or documents falling within the scope of this Section in accordance with the principle of ‘open by design and by default. | (2) Member States may encourage public sector bodies and public undertakings to make available in open format data and documents which are publicly available under national law, provided also that their publication does not pose any risk for the protection of personal data, public security, critical infrastructure, trade secrets or other essential public interests. |
Or. de
Amendment 819
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32p – paragraph 6
| Text proposed by the Commission | Amendment |
|---|---|
| (6) Where making dynamic data available for re-use immediately after collection, as referred to in paragraph 5, would exceed the financial and technical capacities of the public sector body, thereby imposing a disproportionate effort, those dynamic data shall be made available for re-use within a time frame or with temporary technical restrictions that do not unduly impair the exploitation of their economic and social potential. | (6) Where making dynamic data available for re-use immediately after collection, as referred to in paragraph 5, would exceed the financial and technical capacities of the public sector body, thereby imposing a disproportionate effort, those dynamic data shall be made available for re-use within a time frame or with temporary technical restrictions that do not unduly impair the exploitation of their economic and social potential. Temporary technical restrictions may also be applied, to the extent necessary and proportionate, where the immediate or bulk availability of the data would be liable to harm public security or the economic security of the Union or of a Member State. |
Or. en
Amendment 820
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32pa (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (8a) After Article 32p, the following Article 32 is inserted: | |
| 'Article 32pa | |
| Pseudonymisation and request for consent | |
| 1. Where the data or documents made available for re-use under this Chapter contain personal data, the public sector body shall, prior to allowing re-use, apply state-of-the-art privacy-preserving and privacy-enhancing techniques within the meaning of Article 4 of Regulation (EU) 2016/679, including pseudonymisation, so as to reduce the likelihood of attribution of the data to a specific natural person while preserving their utility for the purpose of re-use. | |
| 2. The measures referred to in paragraph 1 shall be designed to protect personal data and data relating to identifiable natural persons against re-identification, against personal data breaches, and against unlawful use and trade, taking into account the means reasonably likely to be used. The residual risk of re-identification, including by algorithmic means, shall be assessed and documented. | |
| 3. Where the re-use of personal data requires the consent of the data subject, the public sector body or the competent body shall facilitate the giving, refusal and withdrawal of that consent, including by automated and machine-readable means and, where appropriate, through a consent and agency-enhancing service provider within the meaning of Article 2, point (38f). Consent obtained for re-use shall be specific to the purposes of re-use and shall not be presumed from consent given for the initial purpose for which the data were collected. | |
| 4. This Article is without prejudice to Regulation (EU) 2016/679, which shall prevail in the event of conflict, and to the conditions for the re-use of certain categories of protected data laid down in Section 3.' |
Or. en
Amendment 821
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32q – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) The re-use of data or documents within the scope of this Section shall be free of charge. However, the recovery by the public sector body holding the data of the marginal costs incurred for the reproduction, provision and dissemination of such data or documents as well as for anonymisation of personal data and measures taken to protect commercially confidential information may be allowed. | (1) The re-use of data or documents within the scope of this Section shall be free of charge. However, the recovery by the public sector body holding the data of the marginal costs incurred for the reproduction, provision and dissemination of such data or documents as well as for anonymisation of personal data, carried out in accordance with state-of-the-art privacy-preserving and privacy-enhancing techniques, and measures taken to protect commercially confidential information may be allowed. |
Or. en
Amendment 822
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32q – paragraph 6
| Text proposed by the Commission | Amendment |
|---|---|
| (6) Public sector bodies may set out higher charges for the re-use of data and documents by very large enterprises than the charges provided for in paragraphs 1, 4 and 5. Any such charges shall be proportionate and based on objective criteria, taking into account the economic power, or the ability of the entity to acquire data, including in particular a designation as a gatekeeper under Regulation (EU) 2022/1925. In addition to the elements listed in paragraph 1 of this Article, such charges may cover the cost of collection, production, reproduction dissemination and data storage and where applicable the cost of anonymisation or measures to protect the confidentiality of the data or documents, together with a reasonable return on investment. | (6) Without prejudice to Article 32r, public sector bodies may set out higher charges for the supply of data and documents by very large enterprises than the charges provided for in paragraphs 1, 4 and 5. Any such charges shall be proportionate and based on objective criteria, taking into account the economic power, or the ability of the entity to acquire data, including in particular a designation as a gatekeeper under Regulation (EU) 2022/1925. In addition to the elements listed in paragraph 1 of this Article, such charges may cover the cost of collection, production, reproduction dissemination and data storage and where applicable the cost of anonymisation or measures to protect the confidentiality of the data or documents, together with a reasonable return on investment. |
Or. en
Amendment 823
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32q – paragraph 6a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (6a) In Article 32q, the following paragraph is inserted: | |
| '6a. Where the re-use by such an enterprise, in particular one established in or controlled from a third country, would be likely to expose high-value or strategically sensitive data to the extraterritorial application of a third-country law or to harm the economic security of the Union or of a Member State, the public sector body may, in addition to or instead of higher charges, make the re-use subject to binding conditions preventing onward transfer, re-identification or misuse, or restrict it to the extent necessary and proportionate to that objective.' |
Or. en
Amendment 824
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32q – paragraph 7
| Text proposed by the Commission | Amendment |
|---|---|
| (7) The re-use of the following shall be free of charge for the user: | (7) The supply and re-use of the following shall be free of charge for the user: |
Or. en
Amendment 825
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation 2023/2854
Article 32q – paragraph 7 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) research data referred to in point (c) of paragraph 1 of Article 32i. | (b) research data referred to in point (c) of paragraph 1 of Article 32i and publicly funded scientific publications. |
Or. en
Amendment 826
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32r – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) When re-use is subject to conditions, those conditions shall not unnecessarily restrict possibilities for re-use and shall not be used to restrict competition. | (2) When re-use is subject to conditions, those conditions shall not unnecessarily restrict possibilities for re-use and shall not be used to restrict competition, nor shall they undermine the principle of open data as freely reusable for any purpose, subject only to proportionate and justified limitations in line with paragraph 1. |
Or. en
Amendment 827
Dario Tamburrano
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32r – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) In Member States where licences are used, public sector bodies shall ensure that the standard licences for the re-use of public sector data or documents, which can be adapted to meet particular licence applications, are available in digital format and able to be processed electronically. | (3) In Member States where licences are used, public sector bodies and public undertakings shall use standard open licences that permit the re-use of data or documents for any purpose and do not discriminate between categories of re-users, unless specific conditions are necessary and proportionate in view of the nature of the data or documents and justified on grounds of a public interest objective. Such licences shall be available in digital format and capable of being processed electronically. |
Or. en
Justification
Standard open licences maximise legal certainty, interoperability and the ability to combine information from different public sources. Specific conditions should be permitted only where they are justified by the nature of the data or documents, not by the identity or economic power of the re-user.
Amendment 828
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32r – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) In Member States where licences are used, public sector bodies shall ensure that the standard licences for the re-use of public sector data or documents, which can be adapted to meet particular licence applications, are available in digital format and able to be processed electronically. | (3) In Member States where licences are used, Member States shall encourage the use of standard licenses for the re-use of public sector data or documents. Public sector bodies shall ensure that such standard licences which can be adapted to meet particular licence applications, are available in digital format and able to be processed electronically and that such licences are, as a default, open licences enabling free and unrestricted re-use, in particular for public interest purposes. |
Or. en
Amendment 829
Aura Salla
Proposal for a regulation
Article 1 – paragraph 1 – point 18
2023/2854
Article 32r – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) In Member States where licences are used, public sector bodies shall ensure that the standard licences for the re-use of public sector data or documents, which can be adapted to meet particular licence applications, are available in digital format and able to be processed electronically. | (3) In Member States where licences are used, Member States shall encourage the use of standard licenses for the re-use of public sector data or documents. public sector bodies shall ensure that such standard licences for the re-use of public sector data or documents, which can be adapted to meet particular licence applications, are available in digital format and able to be processed electronically. |
Or. en
Amendment 830
Michael McNamara, Irena Joveva, Sophie Wilmès, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32r – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) In Member States where licences are used, public sector bodies shall ensure that the standard licences for the re-use of public sector data or documents, which can be adapted to meet particular licence applications, are available in digital format and able to be processed electronically. | (3) In Member States where licences are used, Member States shall encourage the use of standard licenses for the re-use of public sector data or documents. Public sector bodies shall ensure that such standard licences can be adapted to meet particular licence applications, are available in digital format and able to be processed electronically. |
Or. en
Amendment 831
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Matthias Ecke, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32r – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) Public sector bodies may establish special conditions for the re-use of data and documents by very large enterprises. Such conditions shall be proportionate and should be based on objective criteria. They shall be established taking into consideration the economic power, or the ability of the entity to acquire data, including in particular a designation as a gatekeeper under Regulation (EU) 2022/1925. | deleted |
Or. en
Justification
This amendment seeks to preserve the Open Data Directive’s “open by default” principle by ensuring that market concerns are addressed through differentiated charging rather than restrictive licensing. Charging and licensing serve different purposes: fees can be adjusted for very large enterprises without limiting reuse rights. Removing actor-specific licence conditions and reinforcing standard licences will safeguard legal certainty, interoperability, and the ability to combine public sector information across Europe.
Amendment 832
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32r – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) Public sector bodies may establish special conditions for the re-use of data and documents by very large enterprises. Such conditions shall be proportionate and should be based on objective criteria. They shall be established taking into consideration the economic power, or the ability of the entity to acquire data, including in particular a designation as a gatekeeper under Regulation (EU) 2022/1925. | deleted |
Or. en
Amendment 833
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32r – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) Public sector bodies may establish special conditions for the re-use of data and documents by very large enterprises. Such conditions shall be proportionate and should be based on objective criteria. They shall be established taking into consideration the economic power, or the ability of the entity to acquire data, including in particular a designation as a gatekeeper under Regulation (EU) 2022/1925. | deleted |
Or. en
Amendment 834
Dario Tamburrano
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/285
Article 32r – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) Public sector bodies may establish special conditions for the re-use of data and documents by very large enterprises. Such conditions shall be proportionate and should be based on objective criteria. They shall be established taking into consideration the economic power, or the ability of the entity to acquire data, including in particular a designation as a gatekeeper under Regulation (EU) 2022/1925. | deleted |
Or. en
Justification
Differentiated licensing conditions would fragment the open data framework, undermine interoperability and make public sector information difficult or impossible to reuse in open knowledge projects. Economic asymmetries can be addressed through proportionate charging or technical service conditions under Article 32q, without introducing actor-specific licenses.
Amendment 835
Angelika Winzig
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32r – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) Public sector bodies may establish special conditions for the re-use of data and documents by very large enterprises. Such conditions shall be proportionate and should be based on objective criteria. They shall be established taking into consideration the economic power, or the ability of the entity to acquire data, including in particular a designation as a gatekeeper under Regulation (EU) 2022/1925. | (4) Public sector bodies may set different charges for very large enterprises for the re-use of data and documents. Such charges shall be proportionate and should be based on objective criteria. They shall be established taking into consideration the economic power, or the ability of the entity to acquire data, including in particular a designation as a gatekeeper under Regulation (EU) 2022/1925. |
Or. en
Amendment 836
Aura Salla
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32r – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) Public sector bodies may establish special conditions for the re-use of data and documents by very large enterprises. Such conditions shall be proportionate and should be based on objective criteria. They shall be established taking into consideration the economic power, or the ability of the entity to acquire data, including in particular a designation as a gatekeeper under Regulation (EU) 2022/1925. | (4) Public sector bodies may establish special conditions for the re-use of data and documents by very large enterprises with a designation as a gatekeeper under Regulation (EU) 2022/1925. Such conditions shall be proportionate and should be based on objective criteria. They shall be established taking into consideration the economic power, or the ability of the entity to acquire data |
Or. en
Amendment 837
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2864
Article 32t – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Member States shall support the availability of research data by adopting national policies and relevant actions aiming at making publicly funded research data openly available (‘open access policies’), following the principle of ‘open by default’ and compatible with the FAIR principles. In that context, concerns relating to intellectual property rights, personal data protection and confidentiality, security and legitimate commercial interests, shall be taken into account in accordance with the principle of ‘as open as possible, as closed as necessary’. Those open access policies shall be addressed to research performing organisations and research funding organisations. | (1) Member States shall support the availability of research data, as well as scientific publications, by adopting national policies and relevant actions aiming at making publicly funded research data openly available (‘open access policies’), following the principle of ‘open by default’ and compatible with the FAIR principles. In that context, concerns relating to intellectual property rights, personal data protection and confidentiality, security and legitimate commercial interests, shall be taken into account in accordance with the principle of ‘as open as possible, as closed as necessary’. Those open access policies shall be addressed to research performing organisations and research funding organisations. |
Or. en
Amendment 838
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32t – paragraph 1a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1a) A Member State may restrict the dissemination or re-use of certain research data where the applicable framework does not offer sufficient safeguards against the unauthorised transfer of knowledge, the infringement of intellectual property rights, or the exposure of the data to the extraterritorial application of a third-country law liable to harm the security or economic security of the Union or of a Member State. |
Or. en
Justification
The principle of open access to publicly funded research data is qualified by the principle of ‘as open as possible, as closed as necessary’, which already requires that security, intellectual property and legitimate commercial interests be taken into account. In order to give effect to that qualification, and without prejudice to the European Research Area, a Member State should be able to restrict the dissemination or re-use of certain research data where the applicable framework does not adequately protect against the unauthorised transfer of knowledge, the infringement of intellectual property rights, or the exposure of the data to the extraterritorial reach of a third-country law liable to harm the security or economic security of the Union or of a Member State. Confined to what is necessary and proportionate, this possibility reinforces the protection of strategic knowledge and of intellectual property without calling into question the openness of European research.
Amendment 839
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32t – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Without prejudice to Article 32n, paragraph 3, point (d), research data shall be re-usable for commercial or non-commercial purposes in accordance with Section 1 and Section 2 Subsection 3, insofar as they are publicly funded and researchers, research performing organisations or research funding organisations have already made them publicly available through an institutional or subject-based repository. In that context, legitimate commercial interests, knowledge transfer activities and pre-existing intellectual property rights shall be taken into account. | (2) Without prejudice to Article 32n, paragraph 3, point (d), research data, as well as scientific publications, shall be re-usable for commercial or non-commercial purposes in accordance with Section 1 and Section 2 Subsection 3, insofar as they are publicly funded and researchers, research performing organisations or research funding organisations have already made them publicly available through an institutional or subject-based repository. In that context, legitimate commercial interests, knowledge transfer activities and pre-existing intellectual property rights shall be taken into account. |
Or. en
Amendment 840
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32u
| Text proposed by the Commission | Amendment |
|---|---|
| Article 32u | deleted |
Or. pt
Amendment 841
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32u – title
| Text proposed by the Commission | Amendment |
|---|---|
| Thematic categories of high-value datasets | deleted |
Or. pt
Amendment 842
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32u – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) The thematic categories of high-value datasets shall be as set out in Annex I. | (1) The thematic categories of high-value datasets shall be as set out in Annex I. |
Or. pt
Amendment 843
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32u – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) The Commission is empowered to adopt delegated acts in accordance with Article 45(2a) in order to amend Annex I by adding new thematic categories of high-value datasets reflecting technological and market developments. | deleted |
Or. pt
Amendment 844
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32v – paragraph 1 – point da (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (da) In Article 32v, paragraph 1, the following point is inserted: | |
| 'da. where they contain personal data, protected against any misuse or transfer to a third country likely to harm the rights of the persons concerned, by means of anonymisation or, where anonymisation is not possible, of pseudonymisation carried out in accordance with state-of-the-art privacy-preserving and privacy-enhancing techniques;' |
Or. en
Amendment 845
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32v – paragraph 1 – point db (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (db) In Article 32v, paragraph 1, the following point is inserted: | |
| 'db. where they contain data that may be assimilated to trade secrets, know-how or other strategically sensitive economic information, made available in accordance with economic-security safeguards, including binding conditions on the re-user preventing onward transfer or misuse.' |
Or. en
Justification
High-value datasets are made available for re-use free of charge, in machine-readable format and, where relevant, as bulk downloads, precisely because of their significant socio-economic potential. That very openness heightens the risk that datasets containing personal data or strategically sensitive economic information be misused or transferred in a manner harmful to the persons concerned or to the economic security of the Union and its Member States. This amendment ensures that such datasets, where they contain personal data, are protected by anonymisation or by state-of-the-art pseudonymisation, and, where they contain data assimilable to trade secrets, know-how or strategically sensitive economic information, are made available subject to economic-security safeguards, including binding conditions preventing onward transfer or misuse. These guarantees accompany, rather than restrict, the availability of high-value datasets, and are confined to what is necessary and proportionate.
Amendment 846
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32v – paragraph 2 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) generate significant socioeconomic or environmental benefits and innovative services; | (a) generate economic, social and environmental benefits, with the aim of promoting the public interest; |
Or. pt
Amendment 847
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32v – paragraph 2 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) benefit a high number of users, in particular SMEs and SMCs; | (b) benefit a high number of users, in particular SMEs; |
Or. pt
Amendment 848
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32v – paragraph 2 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) assist in generating revenues; and | deleted |
Or. pt
Amendment 849
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32w – paragraph 3 – point a – point ii
| Text proposed by the Commission | Amendment |
|---|---|
| (ii) subject to other forms of preparation of personal data; | deleted |
Or. pt
Amendment 850
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32w – paragraph 3 – point a – point ii
| Text proposed by the Commission | Amendment |
|---|---|
| (ii) subject to other forms of preparation of personal data; | deleted |
Or. en
Amendment 851
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32w – paragraph 5 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) where there is no legal basis other than consent for transmitting the data under Regulation (EU) 2016/679, with the consent of the data subjects; | deleted |
Or. pt
Amendment 852
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32x – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Where a re-user intends to transfer certain categories of protected data that are non-personal to a third country, it shall inform the public sector body of its intention to transfer such data and the purpose of such transfer at the time of requesting the re-use of the data. In the case of re-use based on the data holder’s permission the re-user shall, where appropriate with the assistance of the public sector body, inform the natural or legal person whose rights and interests may be affected of that intention, purpose and the appropriate safeguards. The public sector body shall not allow the re-use unless the natural or legal person gives permission for the transfer. | (1) Where a re-user intends to transfer certain categories of protected data that are non-personal to a third country, it shall inform the public sector body of its intention to transfer such data and the purpose of such transfer at the time of requesting the re-use of the data and, in any event, prior to the conclusion of any sharing agreement. In the case of re-use based on the data holder’s permission the re-user shall, where appropriate with the assistance of the public sector body, and in any event prior to the conclusion of any contractual transfer agreement, inform the natural or legal person whose rights and interests may be affected of that intention, purpose and the appropriate safeguards. The public sector body shall not allow the re-use unless the natural or legal person gives permission for the transfer. |
Or. en
Amendment 853
Mary Khan
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32x – paragraph 1 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1a) In Article 32x, the following paragraph is inserted: | |
| ‘(1a) The transfer to a third country of certain categories of protected data that are non-personal shall be subject to prior authorisation by the national competent authority. Authorisation shall only be granted where there is equivalent legal and effective protection in the third country and where access by foreign authorities outside an applicable international agreement is effectively precluded.’ |
Or. de
Amendment 854
Mary Khan
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation 2023/2854
Article 32x – paragraph 1 b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1b) In Article 32x, the following paragraph is inserted: | |
| ‘(1b) The re-user shall contractually and technically ensure that no onward transfer takes place, that the data is processed only in the authorised secure processing environment and that the public sector body can exercise audit, suspension and recall rights at any time.’ |
Or. de
Amendment 855
Mary Khan
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32x – paragraph 1 c (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1c) In Article 32x, the following paragraph is added: | |
| ‘(1c) If the conditions laid down in paragraphs 1a and 1b cannot be ascertained, the transmission shall be prohibited. A mere contractual commitment by the re-user shall not suffice.’ |
Or. de
Amendment 856
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32x – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) The Commission may adopt implementing acts establishing model contractual clauses for complying with the obligations referred to in paragraph 2 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2). | (3) The Commission may adopt implementing acts establishing model contractual clauses for complying with the obligations referred to in paragraph 2 of this Article. Those model contractual clauses shall ensure the protection of trade secrets, the protection against the unauthorised transfer of knowledge, and the protection of the economic security of the Union and of its Member States. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2). |
Or. en
Amendment 857
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32x – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) Public sector bodies shall, where relevant and to the extent of their capabilities, provide guidance and assistance to re-users in complying with the obligations referred to in paragraph 2. | (4) Public sector bodies shall, where relevant and to the extent of their capabilities, provide guidance and assistance to re-users in complying with the obligations referred to in paragraph 2, in particular by raising the awareness of the parties concerned of the risks arising from the extraterritorial reach of third-country laws, from the unauthorised transfer of knowledge, and from the misuse or re-identification of the data. |
Or. en
Amendment 858
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32x – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| (5) Where justified because of the substantial number of requests across the Union concerning the re-use of non- personal data in specific third countries, the Commission may adopt implementing acts declaring that the legal, supervisory and enforcement arrangements of a third country: | (5) Where justified because of the substantial number of requests across the Union concerning the re-use of non- personal data in specific third countries, the Commission, assisted by the European Data Innovation Board and the European Data Protection Board, may issue guidelines assessing whether the legal, supervisory and enforcement arrangements of a third country: |
Or. en
Amendment 859
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32x – paragraph 5 – subparagraph (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (5a) In Article 32x, the following subparagraph is inserted: | |
| 'Such guidelines shall be without prejudice to the national economic-security frameworks of the Member States, which may restrict or prohibit the transfer of data to a third country irrespective of those guidelines.' |
Or. en
Amendment 860
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32x – paragraph 7 – subparagraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| Specific Union legislative acts may deem certain non-personal data categories held by public sector bodies to be highly sensitive for the purposes of this Article where their transfer to third countries may put at risk Union public policy objectives, such as safety and public health or may lead to the risk of re-identification of non-personal, anonymised data. Where such an act is adopted, the Commission shall adopt delegated acts in accordance with Article 45 supplementing this Regulation by laying down special conditions applicable to the transfers of such data to third countries. | Specific Union legislative acts may deem certain non-personal data categories held by public sector bodies to be highly sensitive for the purposes of this Article where their transfer to third countries may put at risk Union public policy objectives, such as safety and public health or may lead to the risk of re-identification of the natural persons from whom pseudonymised or anonymised data originate. Where such an act is adopted, the Commission assisted by the European Data Innovation Board and the European Data Protection Board, may issue guidelines on the conditions applicable to the transfers of such data to third countries. Such conditions shall be without prejudice to the national economic-security frameworks of the Member States. |
Or. en
Amendment 861
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32y – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Where public sector bodies charge fees, they shall take measures to provide incentives for the re-use of certain categories of protected data for non-commercial purposes, such as scientific research purposes, and by start-ups, SMEs and SMCs in accordance with Union State aid rules. In that regard, public sector bodies may also make the data available at a discounted fee or free of charge, in particular to start-ups, SMEs and SMCs, civil society, research and educational establishments. To that end, public sector bodies may establish a list of categories of re-users to which data or documents for re-use is made available at a discounted fee or free of charge. That list, together with the criteria used to establish it, shall be made public. | (2) Where public sector bodies charge fees, they shall take measures to provide incentives for the re-use of certain categories of protected data for non-commercial purposes, such as scientific research purposes, and by SMEs and start-ups, in accordance with Union State aid rules. In that regard, public sector bodies may also make the data available at a discounted fee or free of charge, in particular to SMEs, start-ups, civil society, research and educational establishments. To that end, public sector bodies may establish a list of categories of re-users to which data or documents for re-use is made available at a discounted fee or free of charge. That list, together with the criteria used to establish it, shall be made public. |
Or. pt
Amendment 862
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32y – paragraph 3 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) anonymisation or other forms of preparation of personal data and commercially confidential data as provided for in Article 32w(3)[conditions for re-use]; | (c) anonymisation or disclosure control in the case of commercially confidential data as provided for in Article 32w(3)[conditions for re-use]; |
Or. en
(As per the deletion under Art. 32w(3)(ii))
Amendment 863
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32y – paragraph 3 – point ea (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ea) In Article 32y, paragraph 3, the following point is added: | |
| '(ea) assisting re-users in seeking consent from data subjects and permission from data holders whose rights and interests may be affected by such re- use.' |
Or. en
Amendment 864
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32z – paragraph 4 – point ea (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ea) In Article 32z, paragraph 4, the following point is added: | |
| '(ea) providing technical support for anonymisation, pseudonymisation and state-of-the-art privacy-preserving methods, including encryption and secure processing environments, not limited to personal data but also extending to commercially confidential information, with particular attention to the residual risk of re-identification taking into account the means reasonably likely to be used;' |
Or. en
Amendment 865
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32 aa – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) The single information point may include a separate, simplified and well-documented information channel for SMEs, SMCs, start-ups and research establishments addressing their needs and capabilities in requesting the re-use of the categories of data referred to in Article 2(54). | (3) The single information point may include a separate, simplified and well-documented information channel for SMEs, start-ups and research establishments addressing their needs and capabilities in requesting the re-use of the categories of data referred to in Article 2(54). |
Or. pt
Amendment 866
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 18
Regulation (EU) 2023/2854
Article 32aa – paragraph 5a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (5a) In article 32aa, the following paragraph is added: | |
| '(a) Member States remain responsible for establishing and operating a single integrated national reporting portal for all statutory reporting obligations, including at a minimum notifications under the CRA, NIS2, CER, DORA, eIDAS and the GDPR. | |
| (b) these national reporting portals are designed to be interoperable on the basis of uniform functional and technical requirements to be set by ENISA; | |
| (c) national reporting portals provide for interoperable, automated and secure transmission of relevant notifications to competent authorities in other Member States and/or to ENISA, where this is necessary under Union law or national law; | |
| (d) ENISA performs a supporting and coordinating role in promoting interoperability, standardisation and quality assurance, without becoming responsible for central storage or processing of all incident notifications at EU level.' |
Or. en
Amendment 867
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 1 – paragraph 1 – point 18 a (new)
Regulation (EU) 2023/2854
Article 37 – paragraph 3a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 18a. In Article 37, the following paragraph is inserted: | |
| '(3a) The powers of the competent authorities are without prejudice to the powers of the data protection authorities, national competition authorities, authorities in charge of cybersecurity and other relevant sectoral authorities. In accordance with their respective competences under Union and national law, those authorities shall establish strong cooperation and exchange information as is necessary for the exercise of their tasks, and shall aim to achieve consistency in the decisions taken in applying this Regulation.' |
Or. en
Amendment 868
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 19
Regulation (EU) 2023/2854
Article 38 – paragraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) with the relevant competent authority in the Member State of their habitual residence, place of work or establishment if they consider that their rights under this Regulation have been infringed; | (a) with the relevant competent authority in the Member State of their habitual residence, place of work or establishment if they consider that their rights or obligations under this Regulation have been infringed; |
Or. en
Justification
Important to ensure users can bring complaints if a data holder infringe their obligations affecting them
Amendment 869
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 19
Regulation (EU) 2023/2854
Article 38 – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) The competent authority with which the complaint has been lodged shall inform the complainant, in accordance with national law, of: | (3) The competent authority with which the complaint has been lodged shall inform the complainant, in accordance with national law, in a timely and meaningful manner, of: |
Or. en
Amendment 870
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 19
Regulation (EU) 2023/2854
Article 38 – paragraph 3 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) the judicial remedies provided for in Article 39. | (b) the administrative, judicial and non-judicial remedies applicable under national and provided for in Article 39. |
Or. en
Justification
This amendment aligns Article 28 with Article 39, which expressly provides that consumers have access to administrative, judicial and non-judicial remedies. To enable consumers to effectively exercise these rights, traders should be required to inform them of all available remedies under applicable national law. Providing complete information enhances transparency, legal certainty and the effective enforcement of consumer rights, while ensuring consistency within the Regulation.
Amendment 871
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 19
Regulation (EU) 2023/2854
Article 38 – paragraph 3a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (3a) In Article 38, the following paragraph is added: | |
| '3a. Competent authorities shall cooperate to handle and resolve complaints effectively and in a timely manner, including by exchanging all relevant information by electronic means, without undue delay. This cooperation shall not affect the cooperation mechanisms provided for by Chapters VI and VII of Regulation (EU) 2016/679 and by Regulation (EU) 2017/2394. The European Commission shall make available means to enhance such cooperation, in particular via relevant software solutions to register and track cases, especially with cross-border relevance.' |
Or. en
Amendment 872
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 19
Regulation (EU) 2023/2854
Article 38 – paragraph 3a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (3a) In Article 38, the following paragraph is added: | |
| '3a. Competent authorities shall cooperate early in the process to handle and resolve complaints effectively and in a timely manner, including by exchanging all relevant information by electronic means, without undue delay. This cooperation shall not affect the cooperation mechanisms provided for by Chapters VI and VII of Regulation (EU) 2016/679 and by Regulation (EU) 2017/2394.’ |
Or. en
Justification
Requiring competent authorities to cooperate early in the process promotes the swift and effective handling of complaints, reduces procedural delays and facilitates the timely exchange of relevant information before issues become more complex. Early cooperation also helps avoid duplication of efforts, supports coherent enforcement across Member States and contributes to greater legal certainty for consumers and traders, while remaining without prejudice to the cooperation mechanisms established under Regulations (EU) 2016/679 and (EU) 2017/2394.
Amendment 873
Michael McNamara, Irena Joveva, Sophie Wilmès, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 1 – paragraph 1 – point 19
Regulation (EU) 2023/2854
Article 38 – paragraph 3a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (3a) In Article 38, the following paragraph is added: | |
| '3a. Competent authorities shall cooperate to handle and resolve complaints effectively and in a timely manner, including by exchanging all relevant information by electronic means, without undue delay. This cooperation shall not affect the cooperation mechanisms provided for by Chapters VI and VII of Regulation (EU) 2016/679 and by Regulation (EU) 2017/2394.' |
Or. en
Amendment 874
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 19 a (new)
Regulation (EU) 2023/2854
Article 38a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 19a. After Article 38, the following Article is inserted: | |
| 'Article 38a | |
| Representation | |
| Without prejudice to Directive (EU) 2020/1828 or to any other type of representation under national law, users shall have the right to mandate a body, organisation or association to exercise the rights conferred by this Regulation on their behalf, provided the body, organisation or association meets all of the following conditions: | |
| (a) It operates on a not-for-profit basis; | |
| (b) It has been properly constituted in accordance with the law of a Member State; | |
| (c) Its statutory objectives include a legitimate interest in ensuring that this Regulation is complied with.' |
Or. en
Justification
This amendment is inspired by Article 86 of the Digital Services Act and aims to encourage the effective exercise of rights by users, as evidence shows that available redress mechanisms are often underused. Introducing an incentive to make these mechanisms more accessible and visible is expected to increase their practical effectiveness. The amendment benefits both consumers and businesses, including SMEs, by facilitating the early resolution of disputes, reducing unnecessary litigation and fostering greater trust and legal certainty in the internal market.
Amendment 875
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 20
Regulation (EU) 2023/2854
Article 40 – paragraph 6
| Text proposed by the Commission | Amendment |
|---|---|
| 20. in Article 40, paragraph (6) is inserted: | deleted |
| ‘6. This Article shall not apply to Chapter VIIc.’ |
Or. en
Justification
This is a direct enforceability point. If Chapter VIIc contains safeguards but is carved out from sanctions, the safeguards become weaker in practice. We stressed that the merger must not weaken enforceability or create fragile rights and obligations.
Amendment 876
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 20
Regulation (EU) 2023/2854
Article 40 – paragraph 6
| Text proposed by the Commission | Amendment |
|---|---|
| 6. This Article shall not apply to Chapter VIIc. | deleted |
Or. en
Amendment 877
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 20
Regulation (EU) 2023/2854
Article 40 – paragraph 6a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 6a. The infringements of the obligations laid down in Chapter VIIc shall be subject to effective, proportionate and dissuasive administrative penalties. Member States shall designate the authorities competent to impose such penalties and shall ensure that they may, in particular, sanction the unlawful transfer of data to third countries, the re-identification of pseudonymised or anonymised data, and any misuse of data re-used under that Chapter. The criteria set out in paragraph 3 shall apply. |
Or. en
Amendment 878
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 20
Regulation (EU) 2023/2854
Article 40 – paragraph 6a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 6b. In Article 40, the following paragraph 6a is inserted: | |
| '6a. For infringements of the obligations laid down in Chapter VIIc, the competent authorities responsible for monitoring the application of that Chapter may, within their scope of competence, impose administrative fines in accordance with national law. The rules on penalties referred to in paragraph 1 shall apply, in particular, to: | |
| (a) the re-use of data or documents in breach of lawfully imposed conditions or for purposes other than those authorised; | |
| (b) the unlawful transfer or onward transfer of data or documents to a third country, or failure to comply with the related information, notification, transparency or safeguard requirements; | |
| (c) failure to comply with obligations protecting intellectual property rights, trade secrets, statistical or commercial confidentiality or other protected data; | |
| (d) the conclusion, maintenance or performance of an exclusivity arrangement prohibited by, or incompatible with, Chapter VIIc; | |
| (e) the intentional or negligent provision of materially inaccurate, incomplete or misleading information in order to obtain a right of re-use; | |
| (f) failure to delete or return data or documents, or to cease their use or re-use, where the applicable conditions are no longer met. | |
| In addition to administrative fines, the competent authorities may, in accordance with national law and where necessary and proportionate, suspend or withdraw the right of re-use, temporarily prohibit new requests for re-use, or order the cessation, deletion or return of the data or documents concerned. When determining the type and level of penalties or other measures, the competent authorities shall take into account the criteria set out in paragraph 3 and, where relevant, the intentional or negligent character of the infringement, any transfer to a third country, the sensitive or strategic nature of the data or documents concerned, and any adverse impact on public or economic security, critical infrastructure, essential services or the essential interests of a Member State. | |
| 7. When applying paragraph 6 to microenterprises and small and medium-sized enterprises, the competent authorities shall take into account their size, economic capacity and any corrective measures taken without undue delay. This shall not preclude effective, proportionate and dissuasive penalties for intentional, repeated or serious infringements.' |
Or. en
Amendment 879
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 22
Regulation (EU) 2023/2854
Article 41a – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) The European Data Innovation Board is established as a means to advising and assisting the Commission in coordinating the enforcement of this Regulation and to serve as a forum of discussion for the development of a European data economy and data policies. | (1) The European Data Innovation Board is established as a means to advising and assisting the Commission and the European Data Protection Board in coordinating the enforcement of this Regulation and to serve as a forum of discussion for the development of a European data economy and data policies. |
Or. en
Amendment 880
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 22
Regulation (EU) 2023/2854
Article 41a – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) The European Data Innovation Board is established as a means to advising and assisting the Commission in coordinating the enforcement of this Regulation and to serve as a forum of discussion for the development of a European data economy and data policies. | (1) The European Data Innovation Board is established to coordinate the enforcement of this Regulation, to advise and assist the Commission and national competent authorities, and to serve as a forum of discussion for the development of a European data economy and data policies. |
Or. en
Amendment 881
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 22
Regulation (EU) 2023/2854
Article 41a – paragraph 1a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1a) The European Data Innovation Board is hereby established as a body of the Union and shall have legal personality. |
Or. en
Amendment 882
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 22
Regulation (EU) 2023/2854
Article 41a – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) It shall be composed at least of representatives of Member States competent for matters related to data, the competent authorities for enforcement of Chapters II, III, V, VIIa and VIIc of this Regulation, the European Data Protection Board, the European Data Protection Supervisor, ENISA, the EU SME Envoy or a representative appointed by the network of SME envoys. The Commission may decide to add additional categories of members. In its appointments of individual experts, the Commission shall aim to achieve gender and geographical balance among the members of the group. | (2) It shall be composed at least of representatives of Member States competent for matters related to data, the competent authorities for enforcement of Chapters II, III, V, VIIa and VIIc of this Regulation, the European Data Protection Board, the European Data Protection Supervisor, ENISA, the EU SME Envoy or a representative appointed by the network of SME envoys. The Commission may decide to add additional categories of members. In its appointments of individual experts, the Commission shall aim to achieve gender and geographical balance among the members of the group. The European Data Innovation Board shall include structured participation from all relevant stakeholders and such participation shall ensure balanced representation and shall not affect the independence of competent authorities. Such participation shall be organised in a manner that ensures the absence of conflicts of interest and safeguards the independence of the Board. |
| In particular, very large enterprises including undertakings designated as gatekeepers under Regulation (EU) 2022/1925 and other natural or legal persons representing them, including interest organisations including them as members, shall be excluded from participation in the stakeholder component of the Board, without prejudice to their ability to be openly consulted in individual proceedings where appropriate and subject to strict conflict-of-interest safeguards. |
Or. en
Amendment 883
Mary Khan
Proposal for a regulation
Article 1 – paragraph 1 – point 22
Regulation (EU) 2023/2854
Article 41a – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) It shall be composed at least of representatives of Member States competent for matters related to data, the competent authorities for enforcement of Chapters II, III, V, VIIa and VIIc of this Regulation, the European Data Protection Board, the European Data Protection Supervisor, ENISA, the EU SME Envoy or a representative appointed by the network of SME envoys. The Commission may decide to add additional categories of members. In its appointments of individual experts, the Commission shall aim to achieve gender and geographical balance among the members of the group. | (2) The European Data Innovation Board shall be composed of one representative appointed by each Member State. The European Data Protection Board, the European Data Protection Supervisor, ENISA and a representative of small and medium-sized enterprises shall participate in an advisory capacity. Additional members may be admitted only by a unanimous decision of the representatives of the Member States. |
Or. de
Justification
A coordination forum shall not become a substitute legislator or a central enforcement body under the control of the Commission.
Amendment 884
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 22
Regulation (EU) 2023/2854
Article 41a – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) The Commission shall decide on the composition of the different configurations in which the Board will fulfil its tasks. | deleted |
Or. en
Amendment 885
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 22
Regulation (EU) 2023/2854
Article 41a – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) The Commission shall decide on the composition of the different configurations in which the Board will fulfil its tasks. | (3) The Commission, taking utmost account of the opinion of the Board and the European Data Protection Board for matters related to the processing of personal data, shall decide on the composition of the different configurations in which the Board will fulfil its tasks. |
Or. en
Amendment 886
Mary Khan
Proposal for a regulation
Article 1 – paragraph 1 – point 22
Regulation 2023/2854
Article 41a – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) The Commission shall decide on the composition of the different configurations in which the Board will fulfil its tasks. | (3) The representatives of the Member States shall decide on the functioning and composition of the respective configurations. Decisions and opinions shall be adopted by consensus. |
Or. de
Justification
A coordination forum shall not become a substitute legislator or a central enforcement body under the control of the Commission.
Amendment 887
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 22
Regulation (EU) 2023/2854
Article 41a – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) The Commission shall chair the meetings of the European Data Innovation Board. | deleted |
Or. en
Amendment 888
Mary Khan
Proposal for a regulation
Article 1 – paragraph 1 – point 22
Regulation (EU) 2023/2854
Article 41a – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) The Commission shall chair the meetings of the European Data Innovation Board.’ | (4) The board shall be chaired by each Member State representative for a period of 12 months, rotating in accordance with the order laid down by the Council. The Commission shall participate without the right to vote and shall provide the secretariat. |
Or. de
Justification
A coordination forum shall not become a substitute legislator or a central enforcement body under the control of the Commission.
Amendment 889
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) serving as a forum for strategic discussions on data policies, data governance, international data flows and cross-sectoral developments relevant to the European data economy; | (a) serving as a forum for strategic discussions on data policies, data governance, international data flows and cross-sectoral developments relevant to the European data economy under this Regulation and in full respect of its competences and tasks, without covering matters covered under Regulation (EU) 2016/679 subject to discussion within the European Data Protection Board and subject to supervision by competent supervisory authorities pursuant to that Regulation; |
Or. en
Amendment 890
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1 – point aa (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (aa) issuing general guidelines to better define the scope and type of data intermediation services providers, and sectoral guidelines to advise data intermediation services providers on the interpretation of the provisions; |
Or. en
Amendment 891
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1 – point ab (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ab) publishing and advertising best practices and use cases; |
Or. en
Amendment 892
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1 – point ac (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ac) providing ready-to-use open source technology stack and tools for data collection; |
Or. en
Amendment 893
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) advising and assisting the Commission with regard to developing consistent practice of competent authorities in the enforcement of Chapters II, III, V, VII, VIIa and VIIc; | (b) advising and assisting national competent authorities and the Commission with regard to developing consistent practice in the enforcement of Chapters II, III, V, VII, VIIa and VIIc; |
Or. en
Amendment 894
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1 – point ba (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ba) regularly exchanging and coordinating with the EDPB, taking utmost account of their feedback in relation to the processing of personal data or the interplay between this Regulation and Regulation (EU) 2016/679; |
Or. en
Amendment 895
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) facilitating cooperation between competent authorities through capacity-building and the exchange of information; | (c) facilitating cooperation between competent authorities through capacity-building and the exchange of information via the maintenance of a secure information sharing system and by establishing methods for the efficient exchange of information relating to the enforcement of the rights and obligations under Chapter II, III and V in cross-border cases, including, coordination with regards to the setting of penalties ; |
Or. en
Amendment 896
Michael McNamara, Irena Joveva, Sophie Wilmès, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) facilitating cooperation between competent authorities through capacity-building and the exchange of information; | (c) facilitating cooperation between competent authorities through capacity-building and the exchange of information, in particular by establishing methods for the efficient exchange of information relating to the enforcement of rights and obligations in cross-border cases, including coordination with regard to the setting of penalties’ ; |
Or. en
Amendment 897
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1 – point da (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (da) collecting best practices and providing technical support for pseudonymisation and ensuring data processing in a manner that effectively preserves the privacy, confidentiality, integrity and accessibility of the information contained in the data for which re-use is allowed, including techniques for the anonymisation, generalisation, suppression and randomisation of personal data or other state-of-the-art privacy-preserving methods, and the deletion of commercially confidential information, including trade secrets or content protected by intellectual property rights; |
Or. en
Justification
Re-instated from Article 7(4)(b) of Regulation (EU) 2022/868, this provision aims to operationalise the uptake of privacy-preserving methods by data holders and data processing services, so as to mitigate the risk of re-identification. This task should be added to the roles of the European Data Innovation Board, in close cooperation with the European Data Protection Board, so as to ensure the protection of natural persons against re-identification and against the unlawful transfer and use of personal data.
Amendment 898
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1 – point da (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (da) ensuring active cooperation and coordination with other relevant bodies to ensure consistency in the single market; |
Or. en
Amendment 899
Michael McNamara, Irena Joveva, Sophie Wilmès, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1 – point da (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (da) advising and assisting the Commission with the development of guidelines and standards. |
Or. en
Amendment 900
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1 – point db (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (db) promoting the adoption and the interoperability of consent and agency-enhancing services across terminal equipment, operating systems, web browsers, applications and individual sites, by supporting the development of common technical specifications enabling consent and objection signals to be portable and mutually recognised across such levels; |
Or. en
Justification
Entrusts the EDIB with promoting the adoption and interoperability of consent and agency-enhancing services across terminal equipment, operating systems, browsers, applications and websites. Interoperability is the condition which prevents the management of consent from being captured by the providers of browsers and operating systems.
Amendment 901
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1 – point db (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (db) advising and assisting the Commission with the development of guidelines and standards |
Or. en
Amendment 902
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1 – point dc (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (dc) assisting participants in AI regulatory sandboxes in complying with Regulation (EU) 2016/679 and this Regulation, including by issuing guidance, supporting the prevention of re-identification risks and facilitating the management of data subjects' consent; |
Or. en
Amendment 903
Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1a) The BEREC shall support the consistent and harmonised application of this Regulation for provisions under Chapter VI and Chapter VIII by providing technical advice on interoperability or on the development of standards to the Commission, by issuing guidelines on interpretation of the Articles, by setting up market monitoring tools and by facilitating regular exchanges with national competent authorities. |
Or. en
Amendment 904
Mary Khan
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1a) Opinions, recommendations, guidelines and other documents produced by the European Data Innovation Board shall not be binding. They shall not replace, modify or, in effect, pre-empt national legislation or the decisions of national authorities. |
Or. de
Justification
It makes sense to introduce some form of coordination but this must not bind national authorities or result in the transfer of sensitive case information to an EU body.
Amendment 905
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1a) Where matters concern personal data, including mixed datasets and pseudonymisation, anonymisation, or data subject rights, the competent authorities under Regulation (EU) 2016/679 are competent. |
Or. en
Amendment 906
Mary Khan
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1 b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1b) The European Data Innovation Board shall not have access to personal data, trade secrets, security-related information or complete case files of national authorities. The exchange of information shall be limited to anonymised and aggregated data, insofar as such data is essential for the provision of advice. |
Or. de
Justification
It makes sense to introduce some form of coordination but this must not bind national authorities or result in the transfer of sensitive case information to an EU body.
Amendment 907
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 23
Regulation (EU) 2023/2854
Article 42 – paragraph 1b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1b) The EDIB shall publish agendas, minutes, non-confidential documents, adopted guidance, and records of stakeholder participation. |
Or. en
Amendment 908
Mary Khan
Proposal for a regulation
Article 1 – paragraph 1 – point 24 – point a
Regulation (EU) 2023/2854
Article 45 – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) The power to adopt delegated acts referred to in Article 29(7), Article 32u(2) and Article 33(2) shall be conferred on the Commission for an indeterminate period of time.’ | (2) The power to adopt delegated acts referred to in Article 29(7), Article 32u(2) and Article 33(2) shall be conferred on the Commission for a period of five years after entry into force of this Regulation. The Commission shall draw up a report in respect of the delegation of power not later than nine months before the end of that period. Any extension shall require the express approval of the European Parliament and of the Council. |
Or. de
Justification
Essential rules of the data economy must be the responsibility of the legislator. Delegated powers must be strictly limited in time and subject to regular political scrutiny.
Amendment 909
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 24 – point a
Regulation (EU) 2023/2854
Article 45 – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| 2. The power to adopt delegated acts referred to in Article 29(7), Article 32u(2) and Article 33(2) shall be conferred on the Commission for an indeterminate period of time. | 2. The power to adopt delegated acts referred to in Article 29(7), Article 32u(2) Article 33(2) and Article 5.1(a) shall be conferred on the Commission for an indeterminate period of time. |
Or. en
Amendment 910
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 1 – paragraph 1 – point 25 – point b
Regulation (EU) 2023/2854
Article 46 – paragraph 1a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (b) the following paragraph 1a is inserted: | deleted |
| ‘1a. Where reference is made to this paragraph, Article 4 of Regulation (EU) No 182/2011 shall apply.’ |
Or. en
Amendment 911
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 26 – point a – point i
Regulation (EU) 2023/2854
Article 49 – paragraph 1 – introductory part
| Text proposed by the Commission | Amendment |
|---|---|
| 1. By 12 September 2028, the Commission shall carry out an evaluation of chapters II, III, IV, V, VI, VII, and VIII and submit a report on its main findings to the European Parliament and to the Council, and to the European Economic and Social Committee. That evaluation shall assess, in particular:’ | 1. By 12 September 2028, the Commission shall carry out an evaluation of this Regulation, in particular the changes introduced via [Regulation (EU)xx/xx Digital Omnibus], and VIII and submit a report on its main findings to the European Parliament and to the Council, and to the European Economic and Social Committee. That evaluation shall assess, in particular:’ |
Or. en
Justification
This amendment preserves the broader scope of the review provided for under the current legal framework by referring to the Regulation as a whole. The proposed limitation of the review would reduce the Commission's obligation to assess the Regulation's overall functioning and effectiveness. Given that these changes were proposed without a dedicated impact assessment, maintaining a comprehensive review clause is necessary to ensure that all aspects of the Regulation can be properly evaluated and, where appropriate, adapted in light of implementation and market developments.
Amendment 912
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 1 – paragraph 1 – point 26 – point a – point i
Regulation (EU) 2023/2854
Article 49 – paragraph 1 – point i
| Text proposed by the Commission | Amendment |
|---|---|
| 1. By 12 September 2028, the Commission shall carry out an evaluation of chapters II, III, IV, V, VI, VII, and VIII and submit a report on its main findings to the European Parliament and to the Council, and to the European Economic and Social Committee. That evaluation shall assess, in particular:’ | 1. By 12 September 2028 and every four years thereafter, the Commission shall carry out an evaluation of chapters II, III, IV, V, VI, VII, and VIII and submit a report on its main findings to the European Parliament and to the Council, and to the European Economic and Social Committee. That evaluation shall assess, in particular:' |
Or. en
Amendment 913
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 26 – point a – point ii – introductory part
Regulation (EU) 2023/2854
Article 49 – paragraph 1 – point m
| Text proposed by the Commission | Amendment |
|---|---|
| (ii) point (m) is replaced by the following: | (ii) after point (m), the following points are added: |
Or. en
Amendment 914
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 26 – point a – point ii
Regulation (EU) 2023/2854
Article 49 – paragraph 1 – point m
| Text proposed by the Commission | Amendment |
|---|---|
| (m) the impact of this Regulation on SMEs and SMCs with regard to their capacity to innovate and to the availability of data processing services for users in the Union and the burden of complying with new obligations | deleted |
Or. en
Justification
This amendments ensures that the Commission assesses whether the new framework increases concentration, weakens rights, or creates enforcement gaps, following concerns that the proposal assumes data availability creates value without asking who benefits or who loses power.
Amendment 915
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 26 – point a – point ii
Regulation (EU) 2023/2854
Article 49 – paragraph 1 – point m
| Text proposed by the Commission | Amendment |
|---|---|
| ‘(m) the impact of this Regulation on SMEs and SMCs with regard to their capacity to innovate and to the availability of data processing services for users in the Union and the burden of complying with new obligations’ | ‘(m) the impact of this Regulation on SMEs with regard to their capacity to innovate and to the availability of data processing services for users in the Union and the burden of complying with new obligations’ |
Or. pt
Amendment 916
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 26 – point a – point ii
Regulation (EU) 2023/2854
Article 49 – paragraph 1 – point ma (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ma) the impact of this Regulation on consumer protection and fundamental rights, including the rights to privacy and the protection of personal data, non-discrimination, access to information, and to an effective remedy; |
Or. en
Amendment 917
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Matthias Ecke, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 26 – point a – point ii
Regulation (EU) 2023/2854
Article 49 – paragraph 1 – point mb (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (mb) the impact of this Regulation on concentration of data access, control, and intermediation power, including the role of undertakings designated as gatekeepers under Regulation (EU) 2022/1925 and other very large enterprises; |
Or. en
Amendment 918
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 26 – point a – point ii
Regulation (EU) 2023/2854
Article 49 – paragraph 1 – point mc (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (mc) the effectiveness of safeguards for mixed datasets, protected data, and data re-use under Chapter VIIc; |
Or. en
Amendment 919
Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
Proposal for a regulation
Article 1 – paragraph 1 – point 26 – point a – point ii
Regulation (EU) 2023/2854
Article 49 – paragraph 1 – point md (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (md) the effectiveness of complaint, redress, supervision, and enforcement mechanisms, including cooperation with supervisory authorities established under Regulation (EU) 2016/679.’ |
Or. en
Amendment 920
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 1 – paragraph 1 – point 26 – point a – point ii a (new)
Regulation (EU) 2023/2854
Article 49 – paragraph 1 – point n
| Text proposed by the Commission | Amendment |
|---|---|
| (iia) In Article 49, paragraph 1, the following point is added: | |
| '(n) the impact of competent authorities’ promotion of data literacy and awareness among users and entities falling within the scope of this Regulation of the rights and obligations under this Regulation.' |
Or. en
Amendment 921
João Oliveira
Proposal for a regulation
Article 1 – paragraph 1 – point 26 – point b
Regulation (EU) 2023/2854
Article 49 – paragraph 2a – point d
| Text proposed by the Commission | Amendment |
|---|---|
| (d) the extent of the increase in re-use of public sector documents to which Section 2 of Chapter VIIc applies, especially by SMEs and SMCs; | (d) the extent of the increase in re-use of public sector documents to which Section 2 of Chapter VIIc applies, especially by SMEs; |
Or. pt
Amendment 922
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph -1 (new)
Regulation (EU) 2016/679
Article 1
| Present text | Amendment |
|---|---|
| -1 Article 1 is replaced by the following: | |
| Subject-matter and objectives | "Subject-matter and objectives |
| 1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data. | 1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data as well as the protection of terminal equipment of users and the confidentiality of information stored thereon. |
| 2. This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. | 2. This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. It further protects the right to privacy in respect to storing information on or gaining access to information stored on terminal equipment of users. |
| 3. The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data. | 3. The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data." |
Or. en
(02016R0679-20160504)
Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
Amendment 923
Axel Voss
Proposal for a regulation
Article 3 – paragraph -1 (new)
Regulation (EU) 2016/679
Article 2 – paragraph 4a
| Present text | Amendment |
|---|---|
| -1 Article 2 is amended by adding the following paragraph: | |
| No equivalent | "4a. Articles [19, 20, 27, 30, 35 to 39] of this Regulation do not apply to small controllers." |
Or. en
Justification
RISK-BASED APPROACH #4: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
Amendment 924
Axel Voss
Proposal for a regulation
Article 3 – paragraph -1 a (new)
Regulation (EU) 2016/679
Article 2 – paragraph 2
| Present text | Amendment |
|---|---|
| -1 a In Article 2, four new points are added to paragraph 2: | |
| 2. This Regulation does not apply to the processing of personal data: | "2. This Regulation does not apply to the processing of personal data: |
| (a) in the course of an activity which falls outside the scope of Union law; | (a) in the course of an activity which falls outside the scope of Union law; |
| (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; | (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; |
| (c) by a natural person in the course of a purely personal or household activity; | (c) by a natural person in the course of a purely personal or household activity; |
| (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security | (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; |
| (da) by natural or legal persons for non-professional or non-commercial purposes; | |
| (db) in the course of an activity that is likely to result in a low risk to the rights and freedoms of natural persons; | |
| (dc) by micro, small and medium-sized enterprises; | |
| (dd) which is of a purely incidental or transitory nature and is carried out for a purpose unrelated to the data subject as an identified or identifiable natural person." |
Or. en
(Regulation (EU) 2016/679)
Justification
SCOPE EXCLUSION #1: This amendment offers an alternative to the proposed risk-based simplification package by excluding non-commercial, low-risk, SME and purely incidental processing from the GDPR’s full scope. It does not deregulate such processing: Member States must ensure protection through other suitable laws, including private-life, contract, consumer, labour, tort, unfair-competition and criminal law. This reduces disproportionate administrative burdens, supports data flows and focuses GDPR enforcement on processing that creates real risks for individuals.
Amendment 925
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph -1 a (new)
Regulation (EU) 2016/679
Article 2
| Present text | Amendment |
|---|---|
| -1 a Article 2 is replaced by the following: | |
| Material scope | "Material scope |
| 1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. | 1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. |
| 2. This Regulation does not apply to the processing of personal data: | 2. This Regulation does not apply to the processing of personal data: |
| (a)in the course of an activity which falls outside the scope of Union law; | (a)in the course of an activity which falls outside the scope of Union law; |
| (b)by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; | (b)by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; |
| (c)by a natural person in the course of a purely personal or household activity; | (c)by a natural person in the course of a purely personal or household activity; |
| (d)by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. | (d)by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. |
| 3. For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98. | 3. For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98. |
| 4. This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive. | 3a. This Regulation applies to the storing of information, or gaining of access to information already stored, in terminal equipment of users. |
| 4. This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive." |
Or. en
(02016R0679-20160504)
Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
Amendment 926
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point -1 (new)
Regulation (EU) 2016/679
Article 2 – paragraph 4 (new)
| Present text | Amendment |
|---|---|
| – In Article 2, a new paragraph is added after paragraph 4: | |
| No equivalent | "4a. Member States shall ensure that the processing of personal data that is exempted from the scope of this Regulation pursuant to paragraphs […] is subject to the obligations of other laws than data protection law, including legislation on the protection of private and family life, contract law, tort law, unfair competition law, consumer law, labor law and criminal law. These other laws shall meet objectives of general interest, especially the free flow of data, and, subject to the principle of proportionality, strike a fair balance between all persons involved in or affected by the data processing." |
Or. en
(Regulation (EU) 2016/679)
Justification
SCOPE EXCLUSION #2: This amendment offers an alternative to the proposed risk-based simplification package by excluding non-commercial, low-risk, SME and purely incidental processing from the GDPR’s full scope. It does not deregulate such processing: Member States must ensure protection through other suitable laws, including private-life, contract, consumer, labour, tort, unfair-competition and criminal law. This reduces disproportionate administrative burdens, supports data flows and focuses GDPR enforcement on processing that creates real risks for individuals.
Amendment 927
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point -1 b (new)
Regulation (EU) 2016/679
Article 3
| Present text | Amendment |
|---|---|
| -1 Article 3 is replaced by the following: | |
| Territorial scope | "Territorial scope |
| 1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. | 1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. |
| 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: | 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: |
| (a)the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or | (a)the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or |
| (b)the monitoring of their behaviour as far as their behaviour takes place within the Union. | (b)the monitoring of their behaviour as far as their behaviour takes place within the Union. |
| 3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law. | 3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law. |
| 4. This Regulation applies to the storing of information, or gaining of access to information already stored, in terminal equipment of users." |
Or. en
(02016R0679-20160504)
Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
Amendment 928
Sibylle Berg, Martin Sonneborn
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (a) In point 1, the following sentences are added: | deleted |
| ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’ |
Or. de
Amendment 929
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – second part
| Text proposed by the Commission | Amendment |
|---|---|
| (a) in point 1, the following sentences are added: | deleted |
| ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’ |
Or. en
Amendment 930
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – second part
| Text proposed by the Commission | Amendment |
|---|---|
| (a) in point 1, the following sentences are added: | deleted |
| ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’ |
Or. en
Amendment 931
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – second part
| Text proposed by the Commission | Amendment |
|---|---|
| (a) in point 1, the following sentences are added: | deleted |
| ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’ |
Or. en
Amendment 932
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – second part
| Text proposed by the Commission | Amendment |
|---|---|
| (a) in point 1, the following sentences are added: | deleted |
| ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’ |
Or. en
Amendment 933
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a – introductory part
Regulation (EU) 2016/679
Article 4 – point 5
| Text proposed by the Commission | Amendment |
|---|---|
| (a) in point 1, the following sentences are added: | (a) in point 5, the following sentences are added: |
| Pseudonymisation does not form part of the definition of personal data laid down in point (1). | |
| Personal data which have undergone pseudonymisation and which could be attributed to a natural person by the use of additional information remain personal data for the controller holding that additional information, and cannot as such be regarded as anonymised. | |
| However, where personal data which have undergone pseudonymisation are made available to another entity, they may cease to be personal data in relation to that entity where the technical and organisational measures referred to in the first subparagraph effectively prevent that entity from attributing the data to the data subject, provided that: | |
| (a) that entity is not in a position to circumvent those measures in the course of any processing carried out under its control; and | |
| (b) those measures also prevent that entity from attributing the data to the data subject by other means reasonably likely to be used, including by combination with other information available to it. | |
| Where it cannot be excluded that the data will be further transmitted to third parties reasonably likely to be able to attribute them to the data subject, the data shall be regarded as personal data in respect of that transmission and of any subsequent processing by those third parties. |
Or. en
Justification
Codifies the judgment of the Court of Justice in Case C-413/23 P (EDPS v SRB) at the place where the Court itself situated it. Pseudonymisation does not form part of the definition of personal data (paragraph 72). Pseudonymised data remain personal data for the controller holding the additional information (paragraph 76) and cannot as such be regarded as anonymised (paragraph 73). They may, however, not be regarded as personal data in relation to a recipient where the technical and organisational measures have been effectively implemented and prevent that recipient from attributing the data to the data subject, including by combination with other information, so that the risk of identification is insignificant (paragraphs 75, 77 and 82). Where onward transmission to third parties able to re-identify cannot be excluded, the data remain personal data (paragraph 85).
Amendment 934
João Oliveira
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – second part
| Text proposed by the Commission | Amendment |
|---|---|
| ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’ | deleted |
Or. pt
Amendment 935
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – second part
| Text proposed by the Commission | Amendment |
|---|---|
| Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. | deleted |
Or. en
Justification
The Commission introduces into the very definition of personal data the principle that information is not personal for an entity which cannot identify the natural person concerned. This exceeds a technical amendment: it modifies the definition of a fundamental right, restricts the scope of the Regulation and creates legal uncertainty, as both the EDPB and the EDPS have stressed. The relativity of identifiability confirmed by the Court of Justice belongs to the notion of pseudonymisation (Case C-413/23 P, paragraphs 71 to 72), not to Article 4(1). The definition of personal data therefore remains unchanged, and the graded regime introduced in the following amendments provides the legal certainty sought without distorting the Court's method.
Amendment 936
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – second part
| Text proposed by the Commission | Amendment |
|---|---|
| Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. | deleted |
Or. en
Amendment 937
Nadine Morano
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – second part
| Text proposed by the Commission | Amendment |
|---|---|
| Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’ | Information relating to a natural person does not necessarily constitute personal data for every person or entity, merely because another person or entity can identify that natural person. Whether or not information constitutes personal data should be assessed on a case-by-case basis, with regard to each person or entity that holds or receives that information, taking into account all means reasonably likely to be used by that person or entity to identify the natural person concerned, including the costs, time required and available technology. Information shall not be personal for a given person or entity where that person or entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used. Depending on the circumstances, pseudonymisation may prevent a person or entity other than the controller from identifying the data subject, such that, for that person or entity, the data subject is not, or is no longer, identifiable. That does not affect the classification of that information as personal data for the controller, nor its obligations under Articles 13 and 14. |
Or. fr
Amendment 938
Francesco Torselli, Paolo Inselvini
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – second part
| Text proposed by the Commission | Amendment |
|---|---|
| Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. | Information relating to a natural person does not necessarily constitute personal data for every other person or entity, merely because another entity is able to identify that natural person. Information shall not constitute personal data for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably available to that entity and to third parties operating in the same sector or geographical context. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates, provided that, where the information refers to economic activities with a high degree of geographical concentration, the combination of geographical, production-related and size-related variables is taken into account for the purposes of assessing the resources that can reasonably be made available. |
| (Our intention is to amend part of the article in question) |
Or. it
Amendment 939
Dario Nardella
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – second part
| Text proposed by the Commission | Amendment |
|---|---|
| Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. | Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity and by third parties operating in the same sector or geographical area. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates, provided that, where the information refers to economic activities with a high degree of geographical concentration, the combination of geographical, production-related and size-related variables is taken into account for the purposes of assessing the resources that can reasonably be made available. |
Or. it
Justification
La modifica al dispositivo dell'articolo 4, punto 1, del regolamento (UE) 2016/679 è coerente con il correttivo interpretativo introdotto al considerando 27 mediante l'Emendamento 1. Non altera l'impostazione della proposta della Commissione secondo cui un'informazione può non costituire dato personale per una determinata entità in mancanza di mezzi ragionevolmente utilizzabili per l'identificazione; ma vincola tale valutazione all'esame dei mezzi accessibili nel contesto settoriale e territoriale pertinente, evitando che la specificità semantica dei dati generati da attività economiche territorializzate produca un effetto di de-protezione.
Amendment 940
Aura Salla, Ana Miguel Pedro, Adina Vălean, Henrik Dahl, Andrea Wechsler, Pekka Toveri, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – second part
| Text proposed by the Commission | Amendment |
|---|---|
| Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. | Information relating to a natural person, depending on the circumstances of the case, is not necessarily personal data for every other person or entity, in so far as that person or entity cannot identify that natural person to whom the information relates taking into account the means reasonably likely to be used by that person or entity, Information relating to a natural person is, however, personal data where this information is likely to be put or is put at the disposal of other persons or entities who have the means reasonably likely to enable the data subject to be identified. |
Or. en
Amendment 941
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – second part
| Text proposed by the Commission | Amendment |
|---|---|
| Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. | Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. |
| The means reasonably likely to be used by a specific entity shall be assessed in the light of that entity's actual technical capabilities, having regard to the ressources, costs, available technical means and time required for identification, rather than hypothetical possibilities. |
Or. en
Amendment 942
Bart Groothuis, Ivars Ijabs, Morten Løkkegaard, Nikola Minchev, Svenja Hahn, Andreas Glück, Katri Kulmuni, João Cotrim De Figueiredo, Ana Vasconcelos
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – second part
| Text proposed by the Commission | Amendment |
|---|---|
| Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. | Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. The parameters of a trained AI model do not constitute personal data where, taking into account the means reasonably likely to be used, a natural person whose personal data was processed during training cannot be identified from the model. |
Or. en
Justification
In line with the case law of the Court of Justice of the European Union (ECLI:EU:C:2025:645), the training of an AI model should not be considered as processing of personal data solely on the ground that its output may contain references to personal data. Such an output constitutes the statistically most probable result generated by the model, rather than the retrieval or reproduction of personal data as such.
Amendment 943
Oliver Schenk, Axel Voss, Marie-Sophie Lanig, Ana Miguel Pedro, Romana Tomc, Marion Walsmann, Lena Düpont, Andrea Wechsler, François-Xavier Bellamy, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – second part
| Text proposed by the Commission | Amendment |
|---|---|
| Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. | Information relating to a natural person, is not personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. That assessment shall take into account objective factors, including but not limited to costs, time, available technology and the legal means available to that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. |
Or. en
Amendment 944
Sebastian Tynkkynen, Diego Solier
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – second part
| Text proposed by the Commission | Amendment |
|---|---|
| Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. | Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used through technical and organisational measures, as well as state of the art technology available to that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. |
Or. en
Amendment 945
Mary Khan
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’ | When determining whether a natural person is identifiable, account shall be taken of all the means reasonably likely to be used by the controller, an actual or foreseeable recipient or any other actor in the processing chain. Pseudonymised data remains personal data, provided that re-identification by an actual or foreseeable recipient is legally and practically possible. The controller shall bear the burden of demonstrating that the risk of re-identification is objectively insignificant, taking into account the state of the art, available additional information and the intended audiences. A contractual ban on re-identification alone shall not suffice. |
Or. de
Justification
Protection must not depend on whether an individual actor claims at any given time that they are unable to identify themselves. What matters is the real risk throughout the entire processing chain.
Amendment 946
Alice Teodorescu Måwe
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – second part
| Text proposed by the Commission | Amendment |
|---|---|
| Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. | Regulation (EU) 2016/679 shall not apply to the processing of personal data, including sensitive personal data, where: (a) the processing is merely transitory in nature; and (b) the processing is for a purpose that is unrelated to the data subject as an identified or identifiable natural person; and (c) appropriate technical and/or organisational safeguards are in place to prevent any use of the data for a purpose related to the data subject as an identified or identifiable natural person up to the point when the data are irreversibly anonymised or erased. |
Or. en
Amendment 947
Alice Teodorescu Måwe
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 1 – third part (new)
| Text proposed by the Commission | Amendment |
|---|---|
| In Article 4, point 1, the following part is added: | |
| 'Data shall not be considered as personal data within the meaning of Regulation (EU) 2016/679 and other Union and national law referring to or relying on the notion of personal data within the meaning of Regulation (EU) 2016/679 insofar as: | |
| (a) the data relate primarily to an entity other than a natural person, such as an enterprise or an object, and the data subject is associated with that entity exclusively as owner, employee or in a similar function; and | |
| (b) processing of the data is for a purpose that is not specifically related to the data subject as an identified or identifiable natural person; and | |
| (c) appropriate technical and/or organisational safeguards are in place to prevent any use of the data for a purpose specifically related to the data subject as an identified or identifiable natural person.' |
Or. en
Amendment 948
Oliver Schenk, Axel Voss, Marie-Sophie Lanig, Ana Miguel Pedro, Romana Tomc, Marion Walsmann, Lena Düpont, François-Xavier Bellamy, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point a
Regulation (EU) 2016/679
Article 4 – point 15
| Text proposed by the Commission | Amendment |
|---|---|
| (15) ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status; Data that merely allow such information to be inferred indirectly shall not be considered data concerning health; |
Or. en
Amendment 949
Sebastian Tynkkynen, Diego Solier
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 32
| Text proposed by the Commission | Amendment |
|---|---|
| (32) ‘terminal equipment’ means terminal equipment as set out in Article 1(1) of Directive 2008/63/EC; | deleted |
Or. en
Amendment 950
Sebastian Tynkkynen, Diego Solier
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 33
| Text proposed by the Commission | Amendment |
|---|---|
| (33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply; | deleted |
Or. en
Amendment 951
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 33
| Text proposed by the Commission | Amendment |
|---|---|
| (33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply; | deleted |
Or. en
Amendment 952
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 33
| Text proposed by the Commission | Amendment |
|---|---|
| (33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply; | (33) the definitions of ‘electronic communications network’, ‘electronic communications service’, ‘interpersonal communications service’ in points (1), (4) and (5) respectively of Article 2 of Directive (EU) 2018/1972 shall apply. |
| For the purposes of this Regulation, the definition of ‘interpersonal communications service’ shall include services whether provided for remuneration or not, as well as services which enable interpersonal and interactive communication merely as a minor ancillary feature that is intrinsically linked to another service; |
Or. en
Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
Amendment 953
Oliver Schenk, Axel Voss, Marie-Sophie Lanig, Marion Walsmann, Andrea Wechsler, François-Xavier Bellamy, Dimitris Tsiodras, Lena Düpont, Romana Tomc, Ana Miguel Pedro, Angelika Niebler, Monika Hohlmeier, Christian Doleschal
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 33
| Text proposed by the Commission | Amendment |
|---|---|
| (33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply; | (33) electronic communications networks’ means transmission systems as defined in of Article 2(1) of Directive (EU) 2018/1972; |
Or. en
Amendment 954
Sebastian Tynkkynen, Diego Solier
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 34
| Text proposed by the Commission | Amendment |
|---|---|
| (34) ‘web browser’ means web browser as defined in Article 2(11) of Regulation (EU) 2022/1925; | deleted |
Or. en
Amendment 955
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 34a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (34a) ‘operating system’ means a system software as defined in Article 2(10) of Regulation (EU) 2022/1925; |
Or. en
Amendment 956
Sebastian Tynkkynen, Diego Solier
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 35
| Text proposed by the Commission | Amendment |
|---|---|
| (35) ‘media service’ means a media service as defined in Article 2(1) of Regulation (EU) 2024/1083; | deleted |
Or. en
Amendment 957
Sebastian Tynkkynen, Diego Solier
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 36
| Text proposed by the Commission | Amendment |
|---|---|
| (36) ‘media service provider’ means a media service provider as defined in Article 2(2) of Regulation (EU) 2024/1083;’ | deleted |
Or. en
Amendment 958
Sebastian Tynkkynen, Diego Solier
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 37
| Text proposed by the Commission | Amendment |
|---|---|
| (37) ‘online interface’ means an online interface as defined in Article 3(m) of Regulation (EU) 2022/2065.’ | deleted |
Or. en
Amendment 959
João Oliveira
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.’ | deleted |
Or. pt
Amendment 960
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2026/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. | deleted |
Or. en
Amendment 961
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. | (38) “scientific research” means any research which: |
| a. follows a methodical and systematic approach; | |
| b. adheres to ethical standards in the relevant research field, including the respect for human autonomy and the concept of consent to participate in research, transparency, accountability and oversight; | |
| c. is genuinely intended to produce verifiable and transparent results; | |
| d. is autonomous and independent and not subject to undue external influence; | |
| e. is carried out with the genuine19 aim of contributing to the growth of society’s general knowledge and wellbeing, which does not exclude subsequent commercial interests and; | |
| f. has the potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways. |
Or. en
Justification
Based on EDPB guidelines 1/2026 on processing of personal data for scientific research purposes of April 2026.
Amendment 962
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. | (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. Scientific research shall not include the profiling of natural persons, direct marketing, the monitoring of individuals' behaviour, or activities whose purpose is to influence or nudge the behaviour of natural persons, even where such activities apply scientific methods. |
Or. en
Amendment 963
Bart Groothuis, Ivars Ijabs, Morten Løkkegaard, Nikola Minchev, Svenja Hahn, Andreas Glück, Katri Kulmuni, João Cotrim De Figueiredo, Ana Vasconcelos
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. | (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. The development, training, testing and validation of new technologies, such as AI systems, AI models and AI agents may be topics of scientific research where it meets the conditions of this point. |
Or. en
Justification
Clarifying that the development of new technologies, such as the training of an LLM, may also be considered as scientific research.
Amendment 964
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. | (38) “scientific research” means any research which can also support innovation, such as technological development, demonstration, applied research and privately funded research. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude research testing or development of AI systems or AI models prior to their being placed on the market or put into service or the aim to further a commercial interest. |
Or. en
Amendment 965
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. | (38) “scientific research” means research conducted in an autonomous and independent manner, with the aim of contributing to the growth of society’s public knowledge, to the public interest or to serve the mankind, generating new or complementing existing scientific knowledge, following a methodological and systematic approach consistent with generally recognised ethical standards, including the respect for human autonomy and the concept of consent to participate in research, as well as standards applicable in the relevant scientific field, producing evidence-based, testable, transparent and published results. |
Or. en
Amendment 966
Henrik Dahl
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. | (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude the research testing or development activity regarding AI systems or AI models prior to their being placed on the market or put into service or the aim to further a commercial interest. |
Or. en
Amendment 967
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. | (38) “scientific research” means any research conducted in autonomous and independent manner, with the aim of contributing to the growth of society´s general knowledge and wellbeing, adhere to recognised ethical standards for scientific research in the public interest, with respect to human autonomy and producing verifiable and transparent results. |
Or. en
Amendment 968
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. | (38) “scientific research” means research that follows a methodical and systematic approach, adheres to all ethical and other standards in the relevant research field, is able to produce verifiable and transparent results, and is carried out in an autonomous and independent manner with the genuine objective of contributing to the growth of society’s general knowledge. |
Or. en
(Linked to the amendments in Articles 24, 79 and 82.)
Justification
based on EDPB-EDPS Joint Opinion and EDPB Guidelines 1/2026, section 2.1
Amendment 969
Sibylle Berg, Martin Sonneborn
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| 38. “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. | 38. “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. |
Or. de
Amendment 970
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Adina Vălean, Andrea Wechsler, Oliver Schenk, Pekka Toveri, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. | (38) “scientific research” means creative and systematic work undertaken in order to increase the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts without any particular application or use in view, or through original investigation undertaken in order to acquire new knowledge directed primarily towards a specific, practical aim or objective. This does not exclude that the research may also aim to further a commercial interest. |
Or. en
Amendment 971
Oliver Schenk, Marie-Sophie Lanig, Axel Voss, Ana Miguel Pedro, Romana Tomc, Marion Walsmann, Lena Düpont, Andrea Wechsler, François-Xavier Bellamy, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Aura Salla
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. | (38) “scientific research” means creative and systematic work undertaken in order to increase the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts without any particular application or use in view, or through original investigation undertaken in order to acquire new knowledge directed primarily towards a specific, practical aim or objective. This does not exclude that the research may also aim to further a commercial interest. |
Or. en
Amendment 972
Ondřej Krutílek
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. | (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards, including scientific methods, in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. |
Or. en
Justification
Generally, the definition should not be too restrictive and prevent innovation. Scientific research is foremostly defined by using scientific methods, which should be explicitly mentioned. The definition should not include restrictive conditions linked to the specific entity conducting the scientific research. The qualification of an activity as scientific research should depend on the nature of the research itself, rather than on the characteristics or status of the organisation carrying it out.
Amendment 973
Mary Khan
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| 38. “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. they shall be carried out with the aim of contributing to the development of the general knowledge and well-being of society, while respecting ethical standards in the field of research concerned. This does not exclude that the research may also aim to further a commercial interest.’ | 38. “scientific research” means methodologically systematic, traceable and accountable research that is carried out in accordance with recognised scientific and ethical standards, follows a documented research agenda and serves the advancement of knowledge or a clearly defined public interest. A commercial interest does not preclude scientific research if it is secondary to the purpose of the research. General product development, targeted advertising, profiling, data trading and the training of general AI systems or AI models are not considered scientific research in themselves. |
Or. de
Justification
Research privileges are intended for genuine science, not to be used as a blanket legal basis for commercial data exploitation.
Amendment 974
Sebastian Tynkkynen, Diego Solier
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. | (38) “scientific research” means any research which can also support competitiveness, innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. |
Or. en
Amendment 975
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38
| Text proposed by the Commission | Amendment |
|---|---|
| (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. | (38) “scientific research” means any research activity including technological development demonstration, fundamental research, applied research and privately funded research. These actions shall contribute to existing scientific knowledge, apply to existing knowledge in novel ways, or be carried out with the aim of contributing to the growth of society´s general knowledge or wellbeing. This does not exclude that the research may also aim to further a commercial interest. |
Or. en
Justification
Scientific research should be defined by its purpose, methodology and contribution to knowledge, not by whether it is carried out by academia, public bodies or companies. The amendment codifies the broad approach already reflected in GDPR Recital 159, covering technological development, demonstration, fundamental, applied and privately funded research. Commercial interest alone should not exclude genuine research from the GDPR research framework or Article 89 safeguards.
Amendment 976
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (38a) ‘small controller’ means any controller, if: | |
| (a) the processing of personal data is not a core business activity of the controller, | |
| (b) does not process special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10 as part of another core business activity of the controller, a department or branch of the controller and | |
| (c) the controller processes personal data of less than [100 000] data subjects in the pending or preceding financial year. |
Or. en
Justification
RISK-BASED APPROACH #5: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
Amendment 977
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (38a) ‘anonymisation’ is the process of rendering personal data anonymous, which means a processing operation that removes any relationship between data and an identified or identifiable natural person (‘data subject’); To determine whether a natural person is identifiable, account should be taken of all the means that can be used now or in the foreseeable future, such as singling out, either by the controller or by any other person to identify the natural person directly or indirectly. |
Or. en
Amendment 978
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (38a) ‘user’ means a natural or legal person using or requesting a publicly available electronic communications service as defined in Article 2(14) of Directive (EU) 2018/1972; |
Or. en
Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
Amendment 979
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (38a) ‘identifiable natural person’ means a natural person who can be identified, directly or indirectly, taking into account all the means reasonably likely to be used; |
Or. en
Amendment 980
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (38a) ‘manufacturer’ means a manufacturer within the meaning of Article 4 of Directive (EU) 2024/2853 of the European Parliament and of the Council. |
Or. en
Amendment 981
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (38b) ‘large controller’ means a controller, if: | |
| (a) it processed personal data of more than [50 000 000] or more than [33]% of the population of any given Member State in the pending or preceding financial year, or | |
| (b) if it was designated a gatekeeper under Article 3 of Regulation (EU) 2022/1925 or a very large online platform or very large online search engine under Article 33 of Regulation (EU) 2022/2065. |
Or. en
Justification
RISK-BASED APPROACH #6: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
Amendment 982
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (38b) 'non-identifiable natural person’, for a given entity, means a natural person whom that entity cannot identify taking into account the means reasonably likely to be used by that entity. |
Or. en
Amendment 983
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (38b) ‘free and open-source software’ means free and open-source software as defined in Article 3(48) of Regulation (EU) 2024/2847. |
Or. en
(linked to Article 24(4)(new))
Amendment 984
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (38b) ‘electronic communications data’ means electronic communications content data and metadata; |
Or. en
Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
Amendment 985
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38c (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (38c) ‘electronic communications metadata’ means data processed in an electronic communications network for the purposes of transmitting, distributing or exchanging electronic communications content, including data used to trace and identify the source and destination of a communication or another type of interaction, data on the location of the terminal equipment or user, data processed or generated in the context of providing services, including additional information about the service, and the date, time, duration and the type of communication, size, route, format and the protocol used and the type of compression. |
Or. en
Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
Amendment 986
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38c (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (38c) ‘pseudonymised data’ means personal data that have undergone technical, organisational or cryptographic privacy-enhancing measures designed to prevent the likelihood of attribution to a specific natural person while preserving their utility for lawful processing purposes, by contrast with anonymisation, which renders the data subject not or no longer identifiable. |
Or. en
Amendment 987
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38c (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (38c) ‘medium controller’ means any controller that is not a small controller or large controller. |
Or. en
Justification
RISK-BASED APPROACH #7: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
Amendment 988
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38d (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (38d) ‘state-of-the-art privacy-preserving and privacy-enhancing methods’ means recognised technical and organisational methods reflecting the state of the art that reduce or eliminate the attribution of data to a natural person, including pseudonymisation and key separation, encryption, aggregation and generalisation, the addition of statistical noise and differential privacy, synthetic data generation, secure multi-party computation and the use of secure processing environments. |
Or. en
Justification
Defines the recognised privacy-enhancing techniques on which the graded regime rests: pseudonymisation and key separation, encryption at rest and in transit, aggregation and generalisation, statistical noise and differential privacy, synthetic data, secure multi-party computation, secure processing environments, and contractual and organisational prohibitions on re-identification. The technical criteria are to be specified by implementing act, in cooperation with the EDPB, so as not to freeze in the Regulation a state of the art which is bound to evolve.
Amendment 989
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 1 – point b
Regulation (EU) 2016/679
Article 4 – point 38d (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (38d) ‘electronic communications content data’ means any data transmitted, distributed or exchanged by means of electronic communications services, in a digital format, such as text, voice, videos, images and sound. Where metadata of other electronic communications services or protocols are transmitted, distributed or exchanged by using the respective service, they shall be considered electronic communications content for the respective service. |
Or. en
Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
Amendment 990
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 2
Regulation (EU) 2026/679
Article 5 – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| 2. Article 5 (1)(b) is replaced by the following: | deleted |
| ‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);’ |
Or. en
Amendment 991
Bart Groothuis, Ivars Ijabs, Morten Løkkegaard, Nikola Minchev, Svenja Hahn, Andreas Glück, Katri Kulmuni, João Cotrim De Figueiredo, Ana Vasconcelos
Proposal for a regulation
Article 3 – paragraph 1 – point 2
Regulation (EU) 2016/679
Article 5 – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’); | collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or for the development, training, testing, validation or use of new technical solutions based on aggregated data, including AI systems and AI models, subject to the safeguards in Article 88c and without prejudice to Article 9 shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’); |
Or. en
Justification
Data collected for one purpose can be reused for research, statistics, archiving, or for training, testing, or using AI systems on data from which individuals are not identifiable, and this reuse is deemed compatible with the original purpose (so no separate legal basis is needed under Art. 6(4)), provided the Article 88c safeguards apply and it doesn't override Article 9 (special category data protections).
Amendment 992
Mary Khan
Proposal for a regulation
Article 3 – paragraph 1 – point 2
Regulation (EU) 2016/679
Article 5 – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);’ | collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall only be considered to be compatible with the initial purposes, when the requirements of Article 6(4) and guarantees of Article 89(1) have been met. General product development as well as the training, testing or validation of general AI systems or AI models shall not be considered compatible purposes solely on the basis of their designation as research (‘purpose limitation’); |
Or. de
Justification
Purpose limitation is a core principle of informational self-determination. A research label shall not replace testing.
Amendment 993
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 2
Regulation (EU) 2016/679
Article 5 – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’); | collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the application of appropriate safeguards in accordance with Article 89(1) and the principle of lawfulness, be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’); |
Or. en
Amendment 994
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 2
Regulation (EU) 2016/679
Article 5 – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’); | collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes; |
Or. en
Amendment 995
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 2
Regulation (EU) 2016/679
Article 5 – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’); | collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, (‘purpose limitation’); |
Or. en
Amendment 996
Sibylle Berg, Martin Sonneborn
Proposal for a regulation
Article 3 – paragraph 1 – point 2
Regulation (EU) 2016/679
Article 5 – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);’ | collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); |
Or. de
Justification
Reinstatement of the currently valid text of the Regulation.
Amendment 997
João Oliveira
Proposal for a regulation
Article 3 – paragraph 1 – point 2
Regulation (EU) 2016/679
Article 5 – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| ‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);’ | ‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the implementation of appropriate safeguards in accordance with Article 89(1), be considered to be compatible with the initial purposes of this Regulation, (‘purpose limitation’);’ |
Or. pt
Amendment 998
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller, Christophe Grudler
Proposal for a regulation
Article 3 – paragraph 1 – point 2 – point i (new)
Regulation (EU) 2016/679
Article 6 – paragraph 4 – point d
| Text proposed by the Commission | Amendment |
|---|---|
| i) In Article 6, paragraph 4, point d is replaced by the following: | |
| '(d) the possible consequences of the intended further processing for data subject, in particular where the data subject is a child;' |
Or. en
Amendment 999
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller, Christophe Grudler
Proposal for a regulation
Article 3 – paragraph 1 – point 2 – point ii (new)
Regulation (EU) 2016/679
Article 6 – paragraph 1 – subparagraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| ii) In Article 6, paragraph 1, the following subparagraph is added: | |
| 'The processing of a child’s personal data for advertising purposes and for the creation of personality and user profiles is not permitted.' |
Or. en
Amendment 1000
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 2 a (new)
Regulation (EU) 2016/679
Article 5 – paragraph 2a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 2a. In Article 5, the following paragraph 2a is inserted: | |
| '2a. Where a controller collects personal data from a third party, or purchases, aggregates, enriches, sells or otherwise makes personal data available to third parties for commercial purposes, it shall, as part of the measures referred to in Article 24, verify and document the lawful origin of the data, the legal basis for their initial collection and for any subsequent processing, the purposes for which they were collected, the categories of data and of data subjects concerned, the information provided pursuant to Articles 13 and 14 and, where applicable, the validity of the consent obtained. | |
| The controller shall not rely solely on a general declaration of compliance or on standard contractual terms supplied by the data provider. Verification shall be strengthened where the circumstances of the processing give rise to reasonable doubt as to the lawfulness of the collection or of the making available of the data, in particular where the data originate from an undisclosed or indeterminate source, where they concern a large number of data subjects, or where they have been obtained through successive transfers. | |
| Where the controller is unable to demonstrate that lawfulness, it shall refrain from processing or from continuing to process the data concerned, and from selling them or making them available to third parties.' |
Or. en
Amendment 1001
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 2 a (new)
Regulation (EU) 2016/679
Article 5 – paragraph 2a (new)
| Present text | Amendment |
|---|---|
| 2a. In Article 5, the following paragraph is added: | |
| No equivalent | "2a. The principles of this Regulation relating to the protection of personal data shall be interpreted in such a way that the requirements of this Regulation are proportionate to the purpose for which they are intended and, in particular, take into account the varying likelihood and severity of the risk that data processing poses to the rights and freedoms of natural persons (risk-based approach). Measures taken to protect personal data must strike a fair balance with the interests or fundamental rights and freedoms of persons other than the data subject." |
Or. en
Justification
INNOVATION PACKAGE #1: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
Amendment 1002
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 2 a (new)
Regulation (EU) 2016/679
Article 7 – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| 2a. In Article 7, paragraph 2 is replaced by the following: | |
| " | |
| (2) If the data subject’s consent is given in the context of a written declaration or a digital interface which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable for each purpose and from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding. | |
| " |
Or. en
Justification
Amendment to make Article 7(2) more tech neutral and reflect the need for specific consent.
Amendment 1003
Angelika Niebler, Monika Hohlmeier
Proposal for a regulation
Article 3 – paragraph 1 – point 2 a (new)
Regulation (EU) 2026/679
Article 5 – paragraph 3a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 2a. In Article 5, the following paragraph 3 is added: | |
| '3a. The principles and obligations laid down in this Regulation shall be applied and interpreted in a manner that is commensurate with the objective pursued by the provision concerned, that restricts the free movement of personal data no further than is necessary, and that gives due weight to the interests and to the fundamental rights and freedoms of persons other than the data subject.' |
Or. en
Amendment 1004
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 2 a (new)
Regulation (EU) 2016/679
Article 7 – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| 2a. Article 7 paragraph 3 is replaced by the following: | |
| '3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to refuse or withdraw consent as to give consent.' |
Or. en
Amendment 1005
Bart Groothuis, Ivars Ijabs, Morten Løkkegaard, Sophie Wilmès, Nikola Minchev, João Cotrim De Figueiredo, Ana Vasconcelos
Proposal for a regulation
Article 3 – paragraph 1 – point 2 a (new)
Regulation (EU) 2016/679
Article 6 – paragraph 1 – point e
| Present text | Amendment |
|---|---|
| 2a. In Article 6, paragraph 1, point e, the following sentence is added: | |
| Article 6, paragraph 1(e) | "This is the case, when processing is necessary for the performance of a task carried out by a Member State related to national security (Article 4(2) TEU)." |
Or. en
(Regulation (EU) 2016/679)
Justification
It should be made possible for Member State authorities to make use of the necessary personal and non-personal (mixed) datasets if it is used for national security purposes. This amendment is however, not intended to narrow the existing exclusion or invite GDPR oversight of national security processing.
Amendment 1006
Kristian Vigenin
Proposal for a regulation
Article 3 – paragraph 1 – point 2 a (new)
Regulation (EU) 2016/679
Article 5 – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| 2a. Article 5, paragraph 2 is amended as follows: | |
| 2. The controller shall be responsible for, and demonstrate compliance with, paragraph 1 (‘accountability’). |
Or. en
Amendment 1007
Pernando Barrena Arza, João Oliveira
Proposal for a regulation
Article 3 – paragraph 1 – point 2 b (new)
Regulation (EU) 2016/679
Article 7 – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| 2b. In Article 7, paragraph 4 is replaced by the following: | |
| '4. When assessing whether consent is freely given and personal data is processed fairly, utmost account shall be taken of whether, inter alia: | |
| (a) the controller has presented all options in a neutral and fair way without highlighting or otherwise prioritizing the option to consent; | |
| (b) the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract, is given or refused; or | |
| (c) the controller has employed designs, choice options, biased texts or other tactics with the aim of achieving consent, when this deviates from the genuine wishes of data subjects.' |
Or. en
Justification
Clarifications to limit the use of dark patterns.
Amendment 1008
Angelika Niebler, Monika Hohlmeier
Proposal for a regulation
Article 3 – paragraph 1 – point 2 b (new)
Regulation (EU) 2016/679
Article 6 – paragraph 4 – subparagraph (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 2b. In Article 6, paragraph 4, the following sentence is added: | |
| 'Where the intended further processing is compatible with the purposes for which the personal data were initially collected, it may rest on the legal basis that justified their collection; a separate legal basis shall not be required.' |
Or. en
Amendment 1009
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 2 b (new)
Regulation (EU) 2016/679
Article 5 – paragraph 2
| Present text | Amendment |
|---|---|
| 2b. In Article 5, paragraph 2 is amended: | |
| 2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). | "2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). When assessing compliance with the accountability obligation, appropriate governance structures, in particular, the appointment of a data protection officer in accordance with Article 37, shall be taken into account." |
Or. en
Justification
DPO Package #1: The amendment strengthens accountability by recognising DPOs as practical governance safeguards and first points of contact for complaints. DPOs already advise controllers and processors, monitor compliance and support data subjects; giving them an explicit complaint-handling role makes resolution faster, less bureaucratic and closer to the facts. Voluntary or shared DPOs are encouraged. Supervisory authorities remain available where the complaint is not addressed or not fully remedied within one month.
Amendment 1010
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 2 b (new)
Regulation (EU) 2016/679
Article 5 – paragraph 3 – subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| 2b. After Article 5, paragraph 3, the following subparagraph is added: | |
| 'This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes the processing of personal data.' |
Or. en
Amendment 1011
Bart Groothuis, Ivars Ijabs, Morten Løkkegaard, Sophie Wilmès, Nikola Minchev
Proposal for a regulation
Article 3 – paragraph 1 – point 2 b (new)
Regulation (EU) 2016/679
Article 6 – paragraph 1 – point e – second sentence
| Present text | Amendment |
|---|---|
| 2b. Article 6 paragraph 1, point e, the following point is added: | |
| (e)processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; | "This is the case, when processing is necessary for the performance of a task carried out by a Member State related to military and defence purposes as mentioned in Article 42 TEU." |
Or. en
(Regulation (EU) 2016/679)
Justification
It should be made possible for Member State authorities to make use of the necessary personal and non-personal (mixed) datasets if it is used for military and defence purposes.
Amendment 1012
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 2 c (new)
Regulation (EU) 2016/679
Article 6 – paragraph 1 – point f –subparagraph
| Present text | Amendment |
|---|---|
| 2c. Article 6, paragraph 1, point f, including the second subparagraph, is amended as follows: | |
| No equivalent | "(fa) processing is necessary for the anonymisation of personal data and that processing serves the principles of data minimisation or storage limitation. |
| (2nd sub-paragaph) For the purposes of point f, controllers that are part of a group of undertakings within the meaning of Article 4, point 19, or institutions affiliated to a central body, shall be presumed to have a legitimate interest in transmitting personal data within that group or between such affiliated institutions for clearly defined internal administrative purposes, including central human resources management, financial and accounting administration, compliance monitoring, IT and cybersecurity management, internal audit, risk management and group reporting, provided that the processing is necessary and proportionate for those purposes and subject to appropriate technical and organisational safeguards. This presumption shall not affect the rights and freedoms of the data subject, including the right to object under Article 21, the processing of special categories of personal data under Article 9, the processing of personal data relating to criminal convictions and offences under Article 10, or the rules on transfers of personal data to third countries or international organisations under Chapter V. | |
| An illustrative list of legitimate interests within the meaning of point f of the first subparagraph is included in Annex II; the Commission is empowered to adopt delegated acts to amend Annex II by adding, deleting or modifying use-cases of legitimate interests, after having consulted the Board referred to in Article 68. Point f of the first subparagraph shall not apply to processing carried out by public authorities where they act in performance of sovereign powers." |
Or. en
Justification
The package makes Article 6 more predictable by clarifying that anonymisation may require a lawful processing step, recognising safeguarded intra-group administrative transfers, and adding a non-exhaustive Annex of legitimate-interest use cases. This supports consistent application across the Union without creating a blanket permission: necessity, proportionality and the balancing test remain required, especially for children. Commission updates after EDPB consultation keep the framework adaptable to new technologies and business practices. (see ANNEX 1a)
Amendment 1013
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 2 d (new)
Regulation (EU) 2016/679
Article 6 – Paragraph 1a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 2d. In Article 6, the following paragraph 1a is inserted: | |
| '(1a) For the purposes of paragraph 1, the creation of a permanent user account or the provision of personal data by the data subject may be required to access offers or to purchase goods or services only where strictly necessary. Where such access or purchase can be ensured without it, the controller shall offer the data subject a clear, easily accessible and non-discriminatory means to proceed, which shall not give rise to less favourable conditions for the data subject.' |
Or. en
Justification
Making access to an offer or the purchase of goods or services conditional on the creation of a permanent user account which is not necessary for the contract deprives consent of its free character, contrary to Article 7(4). The amendment requires the controller to offer a clear, easily accessible and non-discriminatory means to proceed without such an account, which may not give rise to less favourable conditions for the data subject. This is the 'guest experience' which the Court of Justice has already held to be required in comparable circumstances.
Amendment 1014
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 2 d (new)
Regulation (EU) 2016/679
Article 5 – paragraph 1– point c
| Present text | Amendment |
|---|---|
| 2d. Article 5, paragraph 1, point c is deleted: | |
| 1. Personal data shall be: | "1. Personal data shall be:" |
Or. en
(Regulation (EU) 2016/679)
Amendment 1015
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 2 e (new)
Regulation (EU) 2016/679
Article 6 – Paragraph 4a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 2e. In Article 6, the following paragraph 4a is inserted: | |
| '4a. Processing shall be regarded as necessary for the purposes of the legitimate interests pursued within the meaning of point (f) of paragraph 1 only where the following cumulative conditions are met: | |
| (a) the controller or a third party pursues a legitimate interest which is lawful, clearly and precisely articulated, and real and present rather than speculative; | |
| (b) the processing of personal data is necessary for that interest, and that interest cannot reasonably be achieved by other means less intrusive for the data subject, including through the use of anonymised, pseudonymised or synthetic data; | |
| (c) that interest is not overridden by the interests or fundamental rights and freedoms of the data subject, taking into account the nature of the data, the context of the processing, its possible consequences, and the reasonable expectations of the data subject based on their relationship with the controller. | |
| Where the interests or fundamental rights and freedoms of the data subject would override the interest pursued, the controller may implement technical and organisational measures to mitigate the impact of the processing on the data subject; where such measures are insufficient, the processing shall not be based on point (f) of paragraph 1.' |
Or. en
Amendment 1016
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 2 f (new)
Regulation (EU) 2016/679
Article 6 – Paragraph 4b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 2f. In Article 6, the following paragraph 4b is inserted: | |
| '4b. Where personal data are collected from publicly accessible sources by means of web scraping for the purposes of developing or training an artificial intelligence system or model, the processing may be based on point f of paragraph 1 only where the conditions set out in paragraph 1a are met. In assessing whether the interests or fundamental rights and freedoms of the data subject override the interest pursued, account shall be taken in particular of: | |
| (a) the nature of the data, greater weight being given to data revealing highly private information; | |
| (b) the context of the processing, including the volume of data, the number of data subjects and the indiscriminate character of the collection; | |
| (c) the consequences for the data subject, including the difficulty of exercising their rights once the model is trained; | |
| (d) the reasonable expectations of the data subject, having regard to the nature of the source, the publicly accessible character of the data, whether the data subject has manifestly made the data public, and any technical restriction by which the source opposes scraping. | |
| Consent shall not be inferred from the mere online accessibility of personal data, nor from the absence of a technical measure opposing scraping. Where the interests or fundamental rights and freedoms of the data subject would override the interest pursued, the controller may implement mitigating measures, including limiting collection to freely accessible data, excluding sources that oppose scraping, facilitating the right to object including prior to collection, and deleting or anonymising personal data as soon as possible; where such measures are insufficient, the processing shall not be based on point f of paragraph 1.' |
Or. en
Justification
Where personal data are collected from publicly accessible sources by means of web scraping for the purpose of developing or training an artificial intelligence system, reliance on legitimate interest remains subject to the conditions of Article 6(1a). The balancing test takes particular account of the nature of the data, the volume and indiscriminate character of the collection, the difficulty for the data subject of exercising their rights once the model is trained, and the reasonable expectations of the data subject, having regard to the nature of the source and to any technical restriction opposing scraping. The mere online accessibility of personal data does not constitute consent, nor does the absence of a robots.txt file. This codifies the EDPB Guidelines 03/2026.
Amendment 1017
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 2 g (new)
Regulation (EU) 2016/679
Article 7a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 2g. The following Article 7a is inserted: | |
| 'Article 7a | |
| Consent interfaces | |
| 1. Any interface used to request, give, refuse or withdraw consent under this Regulation, including for the storing of, or access to, information in terminal equipment, shall be fair, neutral, intelligible and easily accessible. | |
| 2. Consent shall be freely given, specific, informed and unambiguous. It shall be requested separately for each purpose and require a statement or clear affirmative action. Silence, inactivity, pre-ticked boxes or the mere continued use of a service shall not constitute consent. Fresh consent shall be required for any other purpose. | |
| 3. Consent shall not be freely given where the data subject has no genuine choice, cannot refuse or withdraw consent without detriment, including in the presence of a clear imbalance between the data subject and the controller, or where access to a service, its functionalities or an equivalent version thereof is made conditional on consent to processing, storing or access that is not necessary for that service. | |
| 4. Before consent is given, the data subject shall receive, in clear and plain language, information on the controller, any joint controllers, recipients or categories of recipients relying on the consent, the purposes pursued, the categories of data concerned, the right to withdraw consent, and, where relevant, automated decision-making under Article 22 or transfers to a third country without an adequacy decision or appropriate safeguards. Consent requests shall be clearly distinguishable from other matters and shall not be concealed within general terms and conditions. | |
| 5. Consent interfaces shall not deceive, coerce or manipulate the data subject, give greater prominence to acceptance than to refusal, make refusal, withdrawal or non-consent options less easy, less accessible or more time-consuming than acceptance, or repeat requests in a manner liable to pressure the data subject. Where an option to accept is presented, an equivalent option to refuse shall be presented at the same level of the interface. | |
| 6. Refusing or withdrawing consent shall be as easy as giving consent and shall not entail any cost, disadvantage or degradation of the service. Where consent was given through an electronic interface, withdrawal shall be possible through the same interface. Following withdrawal, the controller shall cease the processing concerned and, in the absence of another lawful basis, erase the data concerned. | |
| 7. Where consent is withdrawn or found to be invalid, the controller shall not retroactively rely on another legal basis under Article 6 to justify the same processing. | |
| 8. The controller shall be able to demonstrate that valid consent was given. The information retained for that purpose shall be limited to what is necessary. | |
| 9. Where this Regulation requires explicit consent, consent shall be given by an express statement.' |
Or. en
Justification
Codifies the EDPB Guidelines 05/2020 on consent and 03/2022 on deceptive design patterns. Consent must be freely given, specific, informed and unambiguous; the interface must be fair and neutral and must not give visual or other prominence to acceptance over refusal, whether through size, colour, positioning or wording; refusal must be as easy to exercise, and as prominent, as acceptance; consent must be capable of being withdrawn as easily as it was given; and the controller may not retroactively rely on another legal basis where consent is withdrawn or found invalid. Consent obtained through a manipulated interface is not consent.
Amendment 1018
João Oliveira
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k
| Text proposed by the Commission | Amendment |
|---|---|
| (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5. | deleted |
Or. pt
Amendment 1019
Sibylle Berg, Martin Sonneborn
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k
| Text proposed by the Commission | Amendment |
|---|---|
| (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5. | deleted |
Or. de
Amendment 1020
Mary Khan
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k
| Text proposed by the Commission | Amendment |
|---|---|
| (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5. | deleted |
Or. de
Justification
Specific categories of data shall not become the general data base for AI. A subsequent removal, which may be waived in the event of ‘disproportionate effort’, does not constitute effective protection.
Amendment 1021
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 –point k
| Text proposed by the Commission | Amendment |
|---|---|
| (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5. | deleted |
Or. en
Amendment 1022
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k
| Text proposed by the Commission | Amendment |
|---|---|
| (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5. | deleted |
Or. en
Amendment 1023
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k
| Text proposed by the Commission | Amendment |
|---|---|
| (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5. | deleted |
Or. en
Amendment 1024
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k
| Text proposed by the Commission | Amendment |
|---|---|
| (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5. | (k) processing in the context of the development and operation of an innovative system or technology that is necessary for the legitimate interests pursued by the controller or by a third party, whether or not such system or technology exists at the time of adoption of this Regulation, of which an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model is a current example, subject to the conditions referred to in paragraph 5, and without prejudice to the prohibited practices laid down in Article 5 of Regulation (EU) 2024/1689, the classification rules for high-risk AI systems laid down in Article 6, the obligations of deployers of high-risk AI systems laid down in Article 26, and the transparency obligations laid down in Article 50 of that Regulation. |
Or. en
Amendment 1025
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Adina Vălean, Henrik Dahl, Andrea Wechsler, Oliver Schenk, Pekka Toveri, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k
| Text proposed by the Commission | Amendment |
|---|---|
| (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5. | (k) incidental and residual processing in the context of the development, training, testing, deployment and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model as referred to in Regulation (EU) 2024/1689, including for the improvement of such systems or models and of related products or services, subject to the conditions referred to in paragraph 5. |
Or. en
Amendment 1026
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9– paragraph 2 – point k
| Text proposed by the Commission | Amendment |
|---|---|
| (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5. | (k) strictly incidental and residual processing in the context of the development of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5. |
Or. en
Amendment 1027
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point k
| Text proposed by the Commission | Amendment |
|---|---|
| (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5. | (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or a GPAI model, subject to the conditions referred to in paragraph 5. |
Or. en
Justification
The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.
Amendment 1028
Sibylle Berg, Martin Sonneborn
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point l
| Text proposed by the Commission | Amendment |
|---|---|
| (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.’ | deleted |
Or. de
Justification
In practice, alternative means of identification are almost always available, so the use of biometric data is by no means ‘necessary’. Establishing the ‘necessity’ of the use would also normalise the use of biometric data, which should be avoided.
Amendment 1029
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point l
| Text proposed by the Commission | Amendment |
|---|---|
| (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject. | deleted |
Or. en
Amendment 1030
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point l
| Text proposed by the Commission | Amendment |
|---|---|
| (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject. | (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (one-to-one verification), and the following conditions are met: |
| (i) the identity confirmation is required by Union or Member Statea national law providing suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; | |
| (ii) the biometric data and the means needed for the verification are under the sole control of the data subject; | |
| (iii) the controller can demonstrate that there are no less intrusive alternative solutions that could achieve the same objective as effectively; and | |
| (iv) the biometric data is deleted after the verification process has been completed. |
Or. en
Amendment 1031
Nadine Morano
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point l
| Text proposed by the Commission | Amendment |
|---|---|
| (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject. | (l) processing of biometric data is authorised when it is used to confirm the identity of a data subject (verification), provided that the biometric data or the means needed for that verification remain under the sole control of the data subject. Where biometric verification is part of an access control process within strategic public transport infrastructure, the storage of biometric data and the means necessary for verification may be under the exclusive control of the controller, provided that such processing is strictly necessary and proportionate, ensures a high level of security, including robust encryption, strict access controls and protection against cyberattacks, and fully respects the fundamental rights and freedoms of the data subjects concerned. |
Or. fr
Amendment 1032
João Oliveira
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 8 – paragraph 2 – point l
| Text proposed by the Commission | Amendment |
|---|---|
| (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.’ | (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the ‘one-to-one’ verification is under the sole control of the data subject, subject to appropriate safeguards to protect the fundamental rights and the interests of the data subject, and provided that the processing is in accordance with this Regulation and does not constitute a new derogation from the prohibition provided for in Article 9(1).’ |
Or. pt
Amendment 1033
Jan-Christoph Oetjen, Svenja Hahn, Andreas Glück
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679 (GDPR)
Article 9 – paragraph 2 – point l
| Text proposed by the Commission | Amendment |
|---|---|
| (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject. | (l) processing of biometric data is necessary for the purpose of verifying the identity or identifying a data subject, provided that biometric data is optional, the data subject has access to a non-biometric alternative of comparable effectiveness and that no photo or video is captured from individuals who do not consent to the facial recognition, and that appropriate safeguards laid down under Union law are applied to ensure the protection of fundamental rights of the data subject. |
Or. en
Amendment 1034
Sebastian Tynkkynen, Diego Solier
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject. | (l) processing of biometric data is strictly necessary for the purpose of confirming the identity of a data subject using one-to-one verification, where the biometric data or the means needed for the recognition is under the sole control of the data subject and occurs on the data subject's device, except in highly exceptional cases where this is strictly necessary, proportional and uses state of the art privacy preserving technology, such as encryption and zero knowledge proofs. |
Or. en
Amendment 1035
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point l
| Text proposed by the Commission | Amendment |
|---|---|
| (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject. | (l) processing of biometric data is strictly necessary and proportionate for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject and subject to appropriate safeguards to protect the fundamental rights and the interests of the data subject, as laid down in Union law or Member State law, in accordance with paragraph 4 of this article. |
Or. en
Amendment 1036
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point l
| Text proposed by the Commission | Amendment |
|---|---|
| (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject. | (l) processing of biometric data for the purposes of uniquely identifying a natural person provided that the use of biometric data is not mandatory, that a non-biometric alternative of comparable effectiveness is available to the data subject and that appropriate safeguards are applied to protect the fundamental rights and interests of the data subject. |
Or. en
Justification
The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.
Amendment 1037
Mary Khan
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point 1
| Text proposed by the Commission | Amendment |
|---|---|
| (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.’ | (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject and the biometric data is neither centrally stored nor further processed for any other purpose.’ |
Or. de
Amendment 1038
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject. | (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the one-to-one verification is under the sole control of the data subject. |
Or. en
Amendment 1039
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point la (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (la) processing is necessary for the development, testing, validation, deployment or improvement of technologies directly or indirectly serving an important public-benefit purpose, provided that: | |
| (i) the processing does not pursue a direct identification of data subjects and a direct allocation of special categories of personal data to an individual person; | |
| (ii) the controller does not take decisions producing legal effects or similarly significant effects concerning identified natural persons on the basis of such processing; | |
| (iii) the processing is limited to what is necessary for the relevant public-benefit purpose; and | |
| (iv) appropriate technical and organisational safeguards are applied, including data minimisation, access restrictions and, where feasible, pseudonymisation or anonymisation. |
Or. en
Justification
The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.
Amendment 1040
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Adina Vălean, Andrea Wechsler, Oliver Schenk, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point la (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (la) processing is strictly necessary for the recognition, management or payment of retirement, disability, dependency or other related pension benefits, where such processing is required by contract or legal provision governing the pension plan, for the sole purpose of verifying and administering the conditions for entitlement, and is subject to appropriate and specific safeguards to protect the fundamental rights and interests of the data subject, including data minimisation, purpose limitation, restricted access and professional secrecy. This provision shall not affect the validity of other legal bases currently relied upon under this Regulation for the processing of health data related to the treatment of certain pension benefits. |
Or. en
Amendment 1041
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point la (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (la) In Article 9, paragraph 2, the following point is inserted: | |
| '(la) processing is necessary for the purpose of scientific research by a recognised organisation that is subject to a Data Protection Impact Assessment, a recognised ethics committee, appropriate technical and organisational measures including pseudonymisation and public registration.' |
Or. en
Amendment 1042
Angelika Niebler, Monika Hohlmeier
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point la (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (la) In Article 9, paragraph 2, the following point is inserted. the other points should be adapted accordingly. | |
| '(la) the processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of precontractual measures taken at the data subject’s request;' |
Or. en
Amendment 1043
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Paulo Cunha, Adina Vălean, Andrea Wechsler, Oliver Schenk, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point lb (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (lb) In Article 9, paragraph 2, the following point is added: | |
| 'lb. processing is necessary and proportionate for the prevention of fraud, the detection and prevention of abuse, bot and spam activity, identity misuse, account takeover or payment fraud, or for ensuring the security of accounts, payments and transactions, provided that the processing is subject to appropriate safeguards for the rights and freedoms of the data subject.' |
Or. en
Amendment 1044
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a
Regulation (EU) 2016/679
Article 9 – paragraph 2 – point lb (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (lb) in Article 9, paragraph 2, the following point is added: | |
| 'lb. processing is necessary for the purposes of carrying out obligations set by other Union law, without cross-references to Regulation (EU) 2016/679.' |
Or. en
Amendment 1045
Oliver Schenk, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Andrea Wechsler, Marie-Sophie Lanig, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Romana Tomc
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a a (new)
Regulation (EU) 2016/679
Article 9 – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (aa) Paragraph 1 of Article 9 is replaced by the following: | |
| Processing of personal data that directly reveals in relation to a specific data subject racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health relating to the physical or mental health status of a natural person, or data concerning a natural person's sex life or sexual orientation shall be prohibited. |
Or. en
Amendment 1046
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point a a (new)
Regulation (EU) 2016/679
Article 9 – paragraph 2a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (aa) In Article 9, the following paragraph is inserted: | |
| '2a. Points k and k under paragraph 2 shall not apply to data concerning health, genetic data, biometric data for the purpose of uniquely identifying a natural person, or personal data used to infer health status, unless such processing is expressly authorised by Union or Member State law and subject to prior consultation with the competent supervisory authority.' |
Or. en
Amendment 1047
Mary Khan
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point b
Regulation (EU) 2016/679
Article 9 – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| (b) the following paragraph shall be added: | deleted |
| For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’ |
Or. de
Justification
Specific categories of data shall not become the general data base for AI. A subsequent removal, which may be waived in the event of ‘disproportionate effort’, does not constitute effective protection.
Amendment 1048
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point b
Regulation (EU) 2016/679
Article 9 – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| (b) the following paragraph is added: | deleted |
| ‘5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’ |
Or. en
Amendment 1049
Sibylle Berg, Martin Sonneborn
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point b
Regulation (EU) 2016/679
Article 9 – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| (5) For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’ | deleted |
Or. de
Amendment 1050
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point b
Regulation (EU) 2016/679
Article 9 – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| 5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties. | deleted |
Or. en
Amendment 1051
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point b
Regulation (EU) 2016/679
Article 9 – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| 5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties. | 5. For processing referred to in point (k) of paragraph 2, strict organisational and technical measures shall be implemented to prevent the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation, the controller shall erase such data without undue delay prior to the completion of the training phase of the AI system or AI model. If erasure of those data from an already trained AI system or AI model proves to be technically impossible, the controller shall fully document the technological impossibility, notify the competent supervisory authority, and without undue delay, and in any event, effectively protect such data by applying state-of-the-art filtering or aligment techniques to guarantee such data cannot be further processed, used to produce outputs, re-identified, disclosed or otherwise made available to third parties. Processing referred to in point k of paragraph 2 should exlude the processing of special categories of personal data originating from data provided by, or generated through, the activity of end users on online platforms or core platfrom services as defined in Regulation (EU) 2022/1925, irrespective of whether such processing occurs during the development, training, or operational phase of any AI system or AI model. |
Or. en
Amendment 1052
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 3 – point b
Regulation (EU) 2016/679
Article 9 – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| 5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties. | 5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data, without undue delay. In assessing whether the removal of those data requires a disproportionate effort, account shall be taken of the state of the art, the costs of implementation, the volume of data concerned, the technical feasibility of isolating or extracting the data, and the nature, scope and purposes of the processing. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data is technically impossible despite documented state-of-the-art measures, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, or re-used for AI outputs, profiling, advertising or other purposes, and from being disclosed or otherwise made available to third parties. In assessing whether the removal of those data requires a disproportionate effort, account shall be taken of the state of the art, the costs of implementation, the volume of data concerned, the technical feasibility of isolating or extracting the data, and the nature, scope and purposes of the processing; or re-used for AI outputs, profiling, advertising or other purposes, |
Or. en
Justification
A general AI derogation should not create a route for the incidental use of patient or health-related data. Health data require a specific legal basis, stronger safeguards and effective supervisory oversight. The same carve-out should be reflected in proposed Article 88c on legitimate interests for AI processing.