amendment list, 27 July 2026
Amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework, and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus)
Document CJ72-AM-791873 · (COM(2025)0837 – 2025/0360(COD))
Committee on Industry, Research and Energy Committee on Civil Liberties, Justice and Home Affairs
Full text
Jump to an amendment (304)
- Amendment 1261
- Amendment 1262
- Amendment 1263
- Amendment 1264
- Amendment 1265
- Amendment 1266
- Amendment 1267
- Amendment 1268
- Amendment 1269
- Amendment 1270
- Amendment 1271
- Amendment 1272
- Amendment 1273
- Amendment 1274
- Amendment 1275
- Amendment 1276
- Amendment 1277
- Amendment 1278
- Amendment 1279
- Amendment 1280
- Amendment 1281
- Amendment 1282
- Amendment 1283
- Amendment 1284
- Amendment 1285
- Amendment 1286
- Amendment 1287
- Amendment 1288
- Amendment 1289
- Amendment 1290
- Amendment 1291
- Amendment 1292
- Amendment 1293
- Amendment 1294
- Amendment 1295
- Amendment 1296
- Amendment 1297
- Amendment 1298
- Amendment 1299
- Amendment 1300
- Amendment 1301
- Amendment 1302
- Amendment 1303
- Amendment 1304
- Amendment 1305
- Amendment 1306
- Amendment 1307
- Amendment 1308
- Amendment 1309
- Amendment 1310
- Amendment 1311
- Amendment 1312
- Amendment 1313
- Amendment 1314
- Amendment 1315
- Amendment 1316
- Amendment 1317
- Amendment 1318
- Amendment 1319
- Amendment 1320
- Amendment 1321
- Amendment 1322
- Amendment 1323
- Amendment 1324
- Amendment 1325
- Amendment 1326
- Amendment 1327
- Amendment 1328
- Amendment 1329
- Amendment 1330
- Amendment 1331
- Amendment 1332
- Amendment 1333
- Amendment 1334
- Amendment 1335
- Amendment 1336
- Amendment 1337
- Amendment 1338
- Amendment 1339
- Amendment 1340
- Amendment 1341
- Amendment 1342
- Amendment 1343
- Amendment 1344
- Amendment 1345
- Amendment 1346
- Amendment 1347
- Amendment 1348
- Amendment 1349
- Amendment 1350
- Amendment 1351
- Amendment 1352
- Amendment 1353
- Amendment 1354
- Amendment 1355
- Amendment 1356
- Amendment 1357
- Amendment 1358
- Amendment 1359
- Amendment 1360
- Amendment 1361
- Amendment 1362
- Amendment 1363
- Amendment 1364
- Amendment 1365
- Amendment 1366
- Amendment 1367
- Amendment 1368
- Amendment 1369
- Amendment 1370
- Amendment 1371
- Amendment 1372
- Amendment 1373
- Amendment 1374
- Amendment 1375
- Amendment 1376
- Amendment 1377
- Amendment 1378
- Amendment 1379
- Amendment 1380
- Amendment 1381
- Amendment 1382
- Amendment 1383
- Amendment 1384
- Amendment 1385
- Amendment 1386
- Amendment 1387
- Amendment 1388
- Amendment 1389
- Amendment 1390
- Amendment 1391
- Amendment 1392
- Amendment 1393
- Amendment 1394
- Amendment 1395
- Amendment 1396
- Amendment 1397
- Amendment 1398
- Amendment 1399
- Amendment 1400
- Amendment 1401
- Amendment 1402
- Amendment 1403
- Amendment 1404
- Amendment 1405
- Amendment 1406
- Amendment 1407
- Amendment 1408
- Amendment 1409
- Amendment 1410
- Amendment 1411
- Amendment 1412
- Amendment 1413
- Amendment 1414
- Amendment 1415
- Amendment 1416
- Amendment 1417
- Amendment 1418
- Amendment 1419
- Amendment 1420
- Amendment 1421
- Amendment 1422
- Amendment 1423
- Amendment 1424
- Amendment 1425
- Amendment 1426
- Amendment 1427
- Amendment 1428
- Amendment 1429
- Amendment 1430
- Amendment 1431
- Amendment 1432
- Amendment 1433
- Amendment 1434
- Amendment 1435
- Amendment 1436
- Amendment 1437
- Amendment 1438
- Amendment 1439
- Amendment 1440
- Amendment 1441
- Amendment 1442
- Amendment 1443
- Amendment 1444
- Amendment 1445
- Amendment 1446
- Amendment 1447
- Amendment 1448
- Amendment 1449
- Amendment 1450
- Amendment 1451
- Amendment 1452
- Amendment 1453
- Amendment 1454
- Amendment 1455
- Amendment 1456
- Amendment 1457
- Amendment 1458
- Amendment 1459
- Amendment 1460
- Amendment 1461
- Amendment 1462
- Amendment 1463
- Amendment 1464
- Amendment 1465
- Amendment 1466
- Amendment 1467
- Amendment 1468
- Amendment 1469
- Amendment 1470
- Amendment 1471
- Amendment 1472
- Amendment 1473
- Amendment 1474
- Amendment 1475
- Amendment 1476
- Amendment 1477
- Amendment 1478
- Amendment 1479
- Amendment 1480
- Amendment 1481
- Amendment 1482
- Amendment 1483
- Amendment 1484
- Amendment 1485
- Amendment 1486
- Amendment 1487
- Amendment 1488
- Amendment 1489
- Amendment 1490
- Amendment 1491
- Amendment 1492
- Amendment 1493
- Amendment 1494
- Amendment 1495
- Amendment 1496
- Amendment 1497
- Amendment 1498
- Amendment 1499
- Amendment 1500
- Amendment 1501
- Amendment 1502
- Amendment 1503
- Amendment 1504
- Amendment 1505
- Amendment 1506
- Amendment 1507
- Amendment 1508
- Amendment 1509
- Amendment 1510
- Amendment 1511
- Amendment 1512
- Amendment 1513
- Amendment 1514
- Amendment 1515
- Amendment 1516
- Amendment 1517
- Amendment 1518
- Amendment 1519
- Amendment 1520
- Amendment 1521
- Amendment 1522
- Amendment 1523
- Amendment 1524
- Amendment 1525
- Amendment 1526
- Amendment 1527
- Amendment 1528
- Amendment 1529
- Amendment 1530
- Amendment 1531
- Amendment 1532
- Amendment 1533
- Amendment 1534
- Amendment 1535
- Amendment 1536
- Amendment 1537
- Amendment 1538
- Amendment 1539
- Amendment 1540
- Amendment 1541
- Amendment 1542
- Amendment 1543
- Amendment 1544
- Amendment 1545
- Amendment 1546
- Amendment 1547
- Amendment 1548
- Amendment 1549
- Amendment 1550
- Amendment 1551
- Amendment 1552
- Amendment 1553
- Amendment 1554
- Amendment 1555
- Amendment 1556
- Amendment 1557
- Amendment 1558
- Amendment 1559
- Amendment 1560
- Amendment 1561
- Amendment 1562
- Amendment 1563
- Amendment 1564
Text 2,603 paragraphs
Amendment 1261
Michael McNamara, Christophe Grudler
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 5a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1a) In Article 41a, the following paragraph 5a is inserted: | |
| '5a. The Commission shall encourage and facilitate the drawing up of a code of conduct on the application of pseudonymisation and anonymisation, at Union level in accordance with the procedure planned in Article 40(7), in order to contribute to the proper application of this Regulation.' |
Or. en
Justification
Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.
Amendment 1262
Michael McNamara, Christophe Grudler
Read the rest (2,591 paragraphs)
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 5b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1b) In Article 41a, the following paragraph 5b is added: | |
| '5b. When preparing a code of conduct on the application of pseudonymisation and anonymisation, in accordance with Article 40(2)(d), due account shall be taken of the European Data Protection Board (EDPB) opinion, as referred to in paragraph 1.' |
Or. en
Justification
Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.
Amendment 1263
Michael McNamara
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (1c) 3. When preparing a code of conduct on the application of pseudonymisation and anonymisation, in accordance with Article 40(2)(d), due account shall be taken of the European Data Protection Board (EDPB) opinion, as referred to in paragraph 1. |
Or. en
Amendment 1264
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) For the purpose of paragraph 1 the Commission shall: | deleted |
| (a) assess the state of the art of available techniques; | |
| (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. |
Or. en
Amendment 1265
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41 – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) For the purpose of paragraph 1 the Commission shall: | (2) 2. Implementing acts adopted under paragraph 1 may in particular: |
Or. en
Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
Amendment 1266
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) assess the state of the art of available techniques; | deleted |
Or. en
Amendment 1267
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) assess the state of the art of available techniques; | (a) specify criteria and methodologies for assessing whether data resulting from anonymisation or pseudonymisation can reasonably be used to identify or re-identify a natural person; |
Or. en
Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
Amendment 1268
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) assess the state of the art of available techniques; | (a) assess the state of the art of available techniques , including Privacy Enhancing Technologies (PET); |
Or. en
Amendment 1269
Oliver Schenk, Eva Maydell, Andrea Wechsler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Angelika Niebler, Axel Voss, Marie-Sophie Lanig, Ana Miguel Pedro, Romana Tomc, Marion Walsmann, Lena Düpont, François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) assess the state of the art of available techniques; | (a) assess the state of the art of available techniques, such as privacy- enhancing technologies; |
Or. en
Amendment 1270
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) assess the state of the art of available techniques; | (a) assess the state of the art of available techniques such as privacy enhancing technologies;; |
Or. en
Amendment 1271
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) assess the state of the art of available techniques; | (a) assess the state of the art of available technical means; |
Or. en
Amendment 1272
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. | deleted |
Or. en
Amendment 1273
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. | (b) develop criteria to assess the risk of re-identification in practice in relation to typical recipients of data. The criteria should take into account, inter alia, the likelihood of identifying a natural person, the possibility of linking records relating to a natural person, and the potential of inferring information concerning a natural person. |
Or. en
Amendment 1274
Ondřej Krutílek
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. | (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical or reasonably foreseeable recipients of data, based on costs, amount of time required, available technology, legal powers and restrictions and all other relevant objective factors. |
Or. en
Justification
The implementing acts should not directly determine the notion of personal data, they should include the core requirements on the means and criteria. It should be done by introducing the reason for why the data lose the status of personal data in relation to specific entities in para (1) and by adapting point 2(b) to cover the basic factors contributing to risk of re-identification (according to recital 26 GDPR). “or reasonably foreseeable” is added to address risk-based determination of other than typical or intended recipients.
Amendment 1275
Oliver Schenk, Eva Maydell, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Andrea Wechsler, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig, François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. | (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data, taking into account objective factors such as cost, amount of time required, available technology, legal obligations. |
Or. en
Amendment 1276
Alice Teodorescu Måwe
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. | (b) develop criteria and or categories for controllers and recipients to assess the risk of data being used for a purpose related to the data subject as an identified or identifiable natural person |
Or. en
Amendment 1277
Katri Kulmuni
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. | (b) develop criteria and or categories for controllers and recipients to assess the risk of data being used for a purpose related to the data subject as an identified or identifiable natural person. |
Or. en
Amendment 1278
Henrik Dahl
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. | (b) develop criteria and or categories for controllers and recipients to assess the risk of data being used for a purpose related to the data subject as an identified or identifiable natural person. |
Or. en
Amendment 1279
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. | (b) develop criteria and or categories for controllers and recipients to assess the risk of data being used for a purpose related to the data subject as an identifiable natural person |
Or. en
Amendment 1280
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. | (b) specify methodologies for assessing risks to the rights and freedoms of natural persons; |
Or. en
Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
Amendment 1281
Oliver Schenk, Eva Maydell, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Axel Voss, Marie-Sophie Lanig, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point ba (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ba) In Article 41a, paragraph 2, the following point ba is added: | |
| '(ba) assess technical, administrative, organisational and contractual measures that can prevent the risk of re-identification.' |
Or. en
Amendment 1282
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point ba (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ba) In Article 41a, paragraph 2, the following point ba is added: | |
| '(ba) establish or approve Union-wide Codes of Conduct pursuant to Article 40 where harmonised application is necessary;' |
Or. en
Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
Amendment 1283
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point bb (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (bb) In Article 41a, paragraph 2, the following point ba is added: | |
| '(bb) establish or approve Certification mechanisms, seals and marks pursuant to Article 42, including certification criteria and conditions for accreditation of certification bodies;' |
Or. en
Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
Amendment 1284
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point bc (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (bc) In Article 41a, paragraph 2, the following point ba is added: | |
| '(bc) specify common technical and organisational measures that may be used to demonstrate compliance with this Regulation;' |
Or. en
Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
Amendment 1285
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 2 – point bd (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (bd) In Article 41a, paragraph 2, the following point ba is added: | |
| '(bd) identify sector-specific circumstances, processing operations or use cases where harmonised interpretation is necessary to avoid fragmentation of the internal market.' |
Or. en
Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
Amendment 1286
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. | deleted |
Or. en
Amendment 1287
Francesco Torselli
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. | (3) In the context of a group of undertakings, data resulting from pseudonymisation shall no longer constitute personal data for an undertaking where: |
| (a) binding intra-group arrangements and appropriate technical and organisational measures, such as logical segregation and access controls, ensure that the undertaking does not have access, and is not reasonably likely to obtain access, to identification keys or additional identifying information held by another group undertaking prohibit any attempt at re-identification, and ensure that the undertaking does not possess other means reasonably likely to enable the re-identification of data subjects; and | |
| (b) the undertaking is able to demonstrate the effectiveness of such arrangements and measures. |
Or. en
Amendment 1288
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – Paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. | (3) The implementation by a controller, processor, data holder or data recipient of the technical and organisational measures and criteria set out in the guidelines referred to in paragraph [1] may be relied upon as an element to demonstrate that the data are not, or are no longer, likely to lead to the re-identification of the data subjects, and that the person concerned has complied with its obligations, including its consent-requesting obligations, under this Regulation. Such reliance shall be without prejudice to the assessment of the specific circumstances of each case by the competent supervisory authority and to the interpretation of Union law by the Court of Justice of the European Union. |
Or. en
Amendment 1289
Oliver Schenk, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Axel Voss, Marie-Sophie Lanig, Ana Miguel Pedro, Marion Walsmann, Romana Tomc, Lena Düpont, Aura Salla, François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. | (3) The implementation of the technical and organisational measures and criteria outlined in an implementing act may be used as an element to demonstrate that pseudonymised data do not lead to reidentification of the data subjects in a specific case. |
Or. en
Amendment 1290
Henrik Dahl
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. | (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot be used for any purpose related to the data subjects as an identified or identifiable natural person. |
Or. en
Amendment 1291
Alice Teodorescu Måwe
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. | (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot be used for any purpose related to the data subjects as an identified or identifiable natural person. |
Or. en
Amendment 1292
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. | (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot be used for any purpose related to the data subjects as an identifiable natural person. |
Or. en
Amendment 1293
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. | (3) Compliance with specifications, criteria or methodologies set out in implementing acts adopted under this Article may be used by controllers and processors as an element to demonstrate compliance with this Regulation. |
Or. en
Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
Amendment 1294
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41 new – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. | (3) The implementation of the means and criteria outlined in an implementing act may be used by an entity as an element to demonstrate that data cannot lead to reidentification of the data subjects by that entity. |
Or. en
Amendment 1295
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. | deleted |
Or. en
Amendment 1296
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. | (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion, which shall be made public, on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. |
Or. en
Amendment 1297
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41 – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. | (4) The Commission shall closely involve the European Data Protection Board in the preparation of implementing acts under this Article. The European Data Protection Board shall issue an opinion within eight weeks of receipt of the draft implementing act. |
Or. en
Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
Amendment 1298
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – Paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3). | deleted |
Or. en
Amendment 1299
Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3). | deleted |
Or. en
Amendment 1300
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 10
Regulation (EU) 2016/679
Article 41a – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3). | (5) The implementing acts referred to in this Article shall be adopted in accordance with the examination procedure referred to in Article 93(3). |
Or. en
Justification
The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.
Amendment 1301
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 10 a (new)
Regulation (EU) 2016/679
Article 41b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 10a. The following Article 41b is inserted: | |
| 'Article 41b | |
| Guidelines on the recipient-specific assessment of data resulting from pseudonymisation | |
| 1. The European Data Protection Board established by Article 68 of Regulation (EU) 2016/679 shall issue guidelines on the application of Article 4, point (1), to data resulting from pseudonymisation, in particular where such data are disclosed to a recipient and may be considered not to constitute personal data for that recipient. | |
| 2. Those guidelines shall address, in particular: | |
| (a) the criteria for assessing whether a recipient is realistically able to identify the data subject, either from the data alone or by combining the data with other information reasonably available to it; | |
| (b) the information, documentation and commitments that may be provided by the recipient concerning its means, access rights, available datasets, technical capabilities, organisational measures, and legal or contractual restrictions; | |
| (c) the proportionate due diligence to be carried out by the controller disclosing the data before relying on the conclusion that the recipient is not realistically able to identify the data subject; | |
| (d) the conditions under which recipients may be grouped by category where their relevant circumstances are materially equivalent; | |
| (e) the evidence to be retained by the controller and, where relevant, by the recipient, in order to demonstrate the basis for the assessment to the competent supervisory authority upon request; | |
| (f) the circumstances in which a material change in the recipient's means, access rights, available datasets, technical capabilities, organisational measures, or legal or contractual restrictions requires the assessment to be reviewed; and | |
| (g) the effect of such assessment on the qualification of the data for the controller, the recipient and any other person that is realistically able to identify the data subject. | |
| 3. The guidelines referred to in paragraph 1 shall take into account the state of the art; relevant case law; supervisory practice; risks of identification through attribution, singling out, linkage, or inference; and the use of technical and organisational measures reducing the risk of identification. | |
| 4. Those guidelines shall not alter the definition of personal data under Article 4, point (1), create a presumption that data resulting from pseudonymisation are not personal data, or reduce the level of protection of personal data under this Regulation.' |
Or. en
Amendment 1302
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Henrik Dahl, Andrea Wechsler, Oliver Schenk, Pekka Toveri, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 10 a (new)
Regulation (EU) 2016/679
Article 41b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 10a. The following Article 41b is inserted: | |
| 'Article 41b | |
| Application of pseudonymisation and identification of a natural person | |
| (1) Controllers and processors may apply pseudonymisation, and anonymisation, or other Privacy Enhancing Technologies referred to in Article 25a to personal data in order to reduce the risks to the data subjects concerned and to help meet their obligations under this Regulation, in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information. To determine whether a natural person is identifiable, including through personal data having undergone pseudonymisation, account shall be taken of all the means reasonably likely to be used, such as singling out or online identifiers, either by the controller or by another person to identify the natural person directly or indirectly. | |
| (2) Paragraph 1 is without prejudice to other provisions and obligations applicable to the controller and processor, including under Chapter IV and V of this Regulation. | |
| (3) The Board shall issue an opinion, in accordance with Article 64(2) of this Regulation, addressing the application of pseudonymisation and anonymisation to personal data, including related technical and organisational measures, and specifying means and criteria to determine whether and when such may effectively prevent persons other than the controller from identifying a data subject, in such a way that, for them, the data subject is not or is no longer identifiable, and where information relating to the data subject no longer constitutes personal data for that person other than the controller. | |
| (4) The Chair of the Board shall request the opinion referred to in paragraph 3 no later than 6 months after the entry into force of this Regulation. The opinion shall be reviewed and updated where necessary. | |
| (5) The Commission may adopt implementing acts specifying technical and organisational criteria, methodologies and standards where necessary to ensure uniform conditions for the application of paragraphs 1 and 3, or where further clarity is required following the issuance of the opinion referred to in paragraph 3, The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).' |
Or. en
Amendment 1303
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 10 a (new)
Regulation (EU) 2016/679
Article 42 – paragraphs 3 and 7
| Present text | Amendment |
|---|---|
| 10a. In Article 42, paragraph 3 and 7 are amended as follows: | |
| 3. The certification shall be voluntary and available via a process that is transparent. | "3. The certification shall be voluntary and available via a process that is transparent for small and medium controllers and large processors. Large controllers must be certified within one year after meeting the conditions in Article 4(28). |
| 7. Certification shall be issued to a controller or processor for a maximum period of three years and may be renewed, under the same conditions, provided that the relevant criteria continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the criteria for the certification are not or are no longer met. | 7. Certification shall be issued to a controller or processor for a maximum period of three years for small and medium controller and large processors. Certifications shall be issued for a maximum period of one year for large controllers. It may be renewed, under the same conditions, provided that the relevant criteria continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the criteria for the certification are not or are no longer met." |
Or. en
Justification
RISK-BASED APPROACH #11: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
Amendment 1304
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 10 a (new)
Regulation (EU) 2016/679
Article 55
| Present text | Amendment |
|---|---|
| 10a. Article 55 is replaced by the following: | |
| Competence | "Article 55 |
| 1. Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State. | Competence |
| 2. Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply. | 1. Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State. |
| 3. Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity. | 2. Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply. |
| 3. Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity. | |
| 4. Each supervisory authority shall be competent to enforce the application of Chapter IXa in relation to processing of information of users who are on their territory. In such cases Article 56 does not apply." |
Or. en
(02016R0679-20160504)
Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
Amendment 1305
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 10 b (new)
Regulation (EU) 2016/679
Article 43 – paragraphs 2 and 7
| Present text | Amendment |
|---|---|
| 10b. In Article 43, paragraphs 2 and 7 are replaced by the following: | |
| 2. Certification bodies referred to in paragraph 1 shall be accredited in accordance with that paragraph only where they have: | "2. Certification bodies referred to in paragraph 1 shall be accredited in accordance with that paragraph only where they have: |
| 7. Without prejudice to Chapter VIII, the competent supervisory authority or the national accreditation body shall revoke an accreditation of a certification body pursuant to paragraph 1 of this Article where the conditions for the accreditation are not, or are no longer, met or where actions taken by a certification body infringe this Regulation. | (ea) have not repeatedly and knowingly certified processing or other conduct that clearly violated guidelines or recommendation under Article 70(1)(d) that was issued before the certification or have not repeatedly and knowingly certified processing that was later subject to corrective powers under Article 58(2) or fines under Article 83. |
| 7. Without prejudice to Chapter VIII, the competent supervisory authority or the national accreditation body shall revoke an accreditation of a certification body pursuant to paragraph 1 of this Article where the conditions for the accreditation are not, or are no longer, met or where actions taken by a certification body infringe this Regulation. Supervisory authorities shall report complaints under Article 77, any exercise of corrective powers under Article 58(2) and any fine under Article 83 against a controller or processor that was certified to the relevant certification body and the competent supervisory authority that has accredited the relevant certification body." |
Or. en
Justification
RISK-BASED APPROACH #12: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
Amendment 1306
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 10 c (new)
Regulation (EU) 2016/679
Article 43a
| Present text | Amendment |
|---|---|
| 10c. The following article is inserted: | |
| No equivalent | "Article 43a |
| Common templates and common methodologies | |
| 1. The Board may prepare and transmit to the Commission a proposal for a list of situations which clearly are or are not subject to the requirement described in Articles 27(2), 33(1), 34(1) and (3), 35(1) and (3), and 37(1)(b) and (c). | |
| 2. The Board may prepare and transmit to the Commission a proposal for a common template and a common methodology for providing information or conducting assessments under Articles 13, 14, 24, 25, 30 and 32 to 36. | |
| 3. The proposals for the lists referred to in paragraphs 41 and for the templates and methodologies referred to in paragraph 62 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2). | |
| 4. The lists and the templates and methodolog referred to in paragraph 3 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 3. | |
| 5. Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Commission adopts the implementing act referred to in paragraph 3." |
Or. en
Justification
The amendment turns GDPR harmonisation into practical compliance relief by enabling EU-level black and white lists, templates and methodologies for recurring duties such as DPIAs, breach notifications, transparency information, records and accountability measures. This reduces divergent national expectations, duplicated assessments and over-compliance for cross-border controllers. EDPB preparation preserves expertise, Commission implementing acts provide legal certainty, and regular reviews keep the tools adaptable.
Amendment 1307
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 10 d (new)
Regulation (EU) 2016/679
Article 44 – paragraphs 1, 1a, 1b (new)
| Present text | Amendment |
|---|---|
| 10d. In Article 44, the first paragraph is amended and the following paragraphs 1a and 1b are inserted: | |
| 1. Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined. | "1. Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the standard of the protection provided for data subjects with regard to general processing of personal data in the third country or by the international organisation is not materially lower than the standard of the protection provided for data subjects by this Regulation. |
| 1a. In order to ensure a coherent and proportionate application of this Regulation, the assessment of safeguards for transfers of personal data to third countries should take into account the risk-based approach applicable under Articles 24 and 32, including the nature, scope, context and purposes of the processing, as well as the technical and organisational measures implemented by controllers and processors. Such assessment should not affect the requirement that data subjects whose personal data are transferred to third countries continue to benefit from a level of protection of fundamental rights and freedoms essentially equivalent to that guaranteed within the Union, in accordance with the Charter of Fundamental Rights of the European Union and the case law of the Court of Justice of the European Union. | |
| 1b. To support efficient data transfers within multinational corporate groups, supervisory authorities should take into account whether companies apply common internal data protection, security and compliance standards across the group. Where a group has binding internal rules, effective safeguards, and mechanisms to protect data subjects’ rights and remedies, this may create a rebuttable presumption that appropriate safeguards under Article 46 are met. Such presumption should not reduce the level of protection guaranteed under this Regulation, the Charter of Fundamental Rights of the European Union, or the case law of the Court of Justice of the European Union, including regarding access to data by public authorities in third countries." |
Or. en
(Regulation (EU) 2016/679)
Justification
The amendments support necessary cross-border data flows for EU companies in global value chains, cloud services and multinational groups. Transfer assessments must remain aligned with the Charter and CJEU case law, but should apply a risk-based and proportionate assessment of the safeguards actually used. Where groups apply binding internal rules, common security standards and effective remedies, a rebuttable presumption under Article 46 can reduce formalism without lowering protection or ignoring public-authority access risks.
Amendment 1308
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 10 e (new)
Regulation (EU) 2016/679
Article 45
| Present text | Amendment |
|---|---|
| 10e. Article 45 replaced by the following: | |
| 1. A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. | "Article 45 |
| 2. Such a transfer shall not require any specific authorisation.When assessing the adequacy of the level of protection, the Commission shall, in particular, take account of the following elements: | Transfers on the basis of an adequacy decision |
| (a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred; | 1. A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures standard of protection which is not materially lower than the standard provided by this Regulation. Such a transfer shall not require any specific authorisation. |
| (b) the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with the data protection rules, including adequate enforcement powers, for assisting and advising the data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and | 2. Such a transfer shall not require any specific authorisation. When assessing the standard of protection, the Commission shall, in particular, take account of the following elements: |
| (c) the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data. | (a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred; |
| 3. The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. 4The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2). | (b) the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with the data protection rules, including adequate enforcement powers, for assisting and advising the data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and |
| 4. The Commission shall, on an ongoing basis, monitor developments in third countries and international organisations that could affect the functioning of decisions adopted pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC. | (c) the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data. |
| 5. The Commission shall, where available information reveals, in particular following the review referred to in paragraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or an international organisation no longer ensures an adequate level of protection within the meaning of paragraph 2 of this Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by means of implementing acts without retro-active effect. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). On duly justified imperative grounds of urgency, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 93(3). | 3. The Commission, after assessing the standard of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an approved standard of protection within the meaning of paragraph 1 and 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2). |
| 6. The Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation giving rise to the decision made pursuant to paragraph 5. | 4. The Commission shall, on an ongoing basis, monitor developments in third countries and international organisations that could affect the functioning of decisions adopted pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC. |
| 7. A decision pursuant to paragraph 5 of this Article is without prejudice to transfers of personal data to the third country, a territory or one or more specified sectors within that third country, or the international organisation in question pursuant to Articles 46 to 49. | 5. The Commission shall, where available information reveals, in particular following the review referred to in paragraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or an international organisation no longer ensures an sufficient level of protection within the meaning of paragraph 1 and 2 of this Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by means of implementing acts without retro-active effect. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). |
| 8. The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that an adequate level of protection is or is no longer ensured. | 6. The Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation giving rise to the decision made pursuant to paragraph 5. |
| 9. Decisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article. | 7. A decision pursuant to paragraph 5 of this Article is without prejudice to transfers of personal data to the third country, a territory or one or more specified sectors within that third country, or the international organisation in question pursuant to Articles 46 to 49. |
| 8. The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that the approved level of protection is or is no longer ensured. | |
| 9. Decisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article." |
Or. en
(Regulation (EU) 2016/679)
Justification
The amendments support necessary cross-border data flows for EU companies in global value chains, cloud services and multinational groups. Transfer assessments must remain aligned with the Charter and CJEU case law, but should apply a risk-based and proportionate assessment of the safeguards actually used. Where groups apply binding internal rules, common security standards and effective remedies, a rebuttable presumption under Article 46 can reduce formalism without lowering protection or ignoring public-authority access risks.
Amendment 1309
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 10 f (new)
Regulation (EU) 2016/679
Article 49 – paragraph 1
| Present text | Amendment |
|---|---|
| 10f. In Article 49, the first paragraph is ammended: | |
| Article 49 | "Article 49 |
| Derogations for specific situations | Derogations for specific situations |
| 1. In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions: | 1. In the absence of a decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:" |
Or. en
(Regulation (EU) 2016/679)
Justification
The amendments support necessary cross-border data flows for EU companies in global value chains, cloud services and multinational groups. Transfer assessments must remain aligned with the Charter and CJEU case law, but should apply a risk-based and proportionate assessment of the safeguards actually used. Where groups apply binding internal rules, common security standards and effective remedies, a rebuttable presumption under Article 46 can reduce formalism without lowering protection or ignoring public-authority access risks.
Amendment 1310
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 11
Regulation (EU) 2016/679
Article 57 – paragraph 1 – point k
| Text proposed by the Commission | Amendment |
|---|---|
| 11. In Article 57(1) is amended as follows: | deleted |
| (a) point (k) is deleted; |
Or. en
Amendment 1311
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Andrea Wechsler, Eva Maydell, Oliver Schenk, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 11 – introductory part
Regulation (EU) 2016/679
Article 57 – paragraph 1 – subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| 11. In Article 57(1) is amended as follows: | 11. In Article 57, paragraph 1 is amended as follows: |
| In paragraph 1, the following subparagraph is added: | |
| 'National supervisory authorities shall refrain from adopting guidelines, recommendations and best practices on matters already covered by guidelines, recommendations and best practices issued by the Board and, where necessary, shall update or repeal their national documentation adopted prior to guidelines, recommendations and best practices adopted by the Board in order to ensure consistency of interpretation of this Regulation.' |
Or. en
Amendment 1312
Oliver Schenk, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Axel Voss, Ana Miguel Pedro, Marie-Sophie Lanig, Romana Tomc, Marion Walsmann, Lena Düpont, Aura Salla, François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 11 – point a a (new)
Regulation (EU) 2016/679
Article 57 – paragraph 1 – point aa (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (aa) In Article 57, paragraph 1, the following point aa is inserted: | |
| '(aa) handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80 and investigate, in the case of a complaint by a data subject at its discretion, to the extent approriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisor authority is necessary;' |
Or. en
Amendment 1313
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 11 – point a a (new)
Regulation (EU) 2016/679
Article 57 – paragraph 1 – point d
| Present text | Amendment |
|---|---|
| (aa) In Article 57, paragraph 1, point d is amended as follows: | |
| promote the awareness of controllers and processors of their obligations under this Regulation; | "(d) promote the awareness of controllers and processors of their obligations under this Regulation, and in doing so due regard is given to the principle of proportionality, taking into account the nature, scope, context, risk, and purposes of the processing, while coordinating, where applicable, with the relevant competent sectoral authorities." |
Or. en
Justification
INNOVATION PACKAGE #2: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
Amendment 1314
Oliver Schenk, Eva Maydell, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig, Aura Salla, François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 11 – point a b (new)
Regulation (EU) 2016/679
Article 57 – paragraph 1 – va
| Text proposed by the Commission | Amendment |
|---|---|
| (ab) In Article 57, paragraph 1, the following point va is added: | |
| '(va) set up regulatory sandboxes to facilitate testing the compliance of specific techniques or technological solutions to be used for the data processing activities with the obligations under this Regulation or whether the data processing results in data that would be exempt from this Regulation.' |
Or. en
Amendment 1315
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 11 – point a b (new)
Regulation (EU) 2016/679
Article 57 – paragraph 1 – point f
| Present text | Amendment |
|---|---|
| (ab) In Article 57, paragraph 1, point f is amended: | |
| handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary; | "(f) in handling complaints, the supervisory authority may determine the order of priority according to the seriousness of the alleged infringement and its impact on the rights of data subjects, and may allocate its investigative resources accordingly, provided that each complaint is handled with due diligence;" |
Or. en
Justification
INNOVATION PACKAGE #3: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
Amendment 1316
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 11 a (new)
Regulation (EU) 2016/679
Article 57 – paragraph 2
| Present text | Amendment |
|---|---|
| 11a. In Article 57, paragraph 2 is amended as follows: | |
| 2. Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication. | "2. Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form. Supervisory authority may establish the mandatory use of electronical forms and set up conditions for other means of communication in exceptional cases." |
Or. en
Justification
INNOVATION PACKAGE #4: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
Amendment 1317
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 11 b (new)
Regulation (EU) 2016/679
Article 57 – paragraphs 4a, 4b, 4c (new)
| Present text | Amendment |
|---|---|
| 11b. In Article 57, the following paragraphs are added: | |
| No equivalent | "4a. In fullfilling their tasks supervisory authorities shall take into account that the right to the protection of personal data is not an absolute right and must be considered in relation to its function in society and balanced against other fundamental rights, in accordance with the principle of proportionality. They must have inter alia regard of the following as far as relevant in the specific circumstances: |
| (a) the desirability of promoting innovation; | |
| (b) the desirability of promoting competition; | |
| (c) the importance of the prevention, investigation, detection and prosecution of criminal offences; | |
| (d) the need to safeguard public security and national security; | |
| (e) the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing. | |
| 4b. Supervisory authorities shall, where appropriate, consult and cooperate on national and Union as well as in appropriate cross-border procedures with other regulatory bodies, whose regulatory tasks and powers might are related to the protection of personal data and the free flow of personal data within the Union. When consulting those and cooperating with those other regualtory bodies supervisory authorities praticularly shall take into account the matters according to paragraph 5. The Commission may adopt, by means of an implementing act, procedural rules for the sharing of personal data, business secrets, purpose limititation and other procedural aspects necessary to ensure professional secrecy. | |
| 4c. Supervisory authority shall establish a permanent panel of stakeholder representatives to ensure that they fulfill their tasks, especially regarding the matters described in paragraph 4 duely and monitor relevant developments, insofar as they have an impact on the protection of personal data and the free flow of personal data, in particular the development of information and communication technologies and commercial practices. The Commission may adopt, by means of an implementing act, rules for the appointement and the statue oft he members oft he panel and procedural requirements which ensure professional secrecy and transparency." |
Or. en
Justification
INNOVATION PACKAGE #5: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
Amendment 1318
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 11 c (new)
Regulation (EU) 2016/679
Article 58 – paragraph 2a (new)
| Present text | Amendment |
|---|---|
| 11c. In Article 58 the following paragraph 2a is added: | |
| No equivalent | "(2a) When deciding whether and which of the corrective powers referred to in paragraph 2 to exercise, the supervisory authority shall act according to its dutiful discretion, having regard to the criteria listed in Article 83(2), to the effective protection of the data subject and to the efficient use of its resources. It may refrain from exercising a corrective power where the infringement is minor or has been remedied and its exercise is not necessary to ensure compliance with this Regulation. The obligation to ensure that infringements are brought to an end remains unaffected." |
Or. en
Justification
INNOVATION PACKAGE #6: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
Amendment 1319
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 12
Regulation (EU) 2016/679
Article 64 – paragraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| 12. In Article 64(1), point (a) is deleted. | deleted |
Or. en
Amendment 1320
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 12 a (new)
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point e
| Present text | Amendment |
|---|---|
| 12a. In Article 70, paragraph 1, point e is amendend as follows: | |
| (e) examine, on its own initiative, on request of one of its members or on request of the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation; | "(e) examine, on its own initiative, on request of one of its members or on request of the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation; in doing so, the Board shall ensure that such guidance: |
| i. remains consistent with the wording, scope, objectives, and risk-based structure of this Regulation, | |
| ii. respects the principles of proportionality and legal certainty and does not introduce substantive obligations beyond those laid down in Union law, | |
| iii. is accompanied by a published legal assessment confirming its legal basis, feasibility, and conformity with the principles of this Regulation, | |
| iv. where applicable, informed by, and coordinated with relevant competent sectoral authorities." |
Or. en
Justification
INNOVATION PACKAGE #7: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
Amendment 1321
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 12 a (new)
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point b
| Present text | Amendment |
|---|---|
| 12a. In Article 70 paragraph 1, point b is replaced by the following: | |
| (b) advise the Commission on any issue related to the protection of personal data in the Union, including on any proposed amendment of this Regulation; | "(b) advise the Commission on any issue related to the protection of personal data and the confidentiality of communications in the Union, including on any proposed amendment of this Regulation;" |
Or. en
(02016R0679-20160504)
Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
Amendment 1322
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 13
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point h
| Text proposed by the Commission | Amendment |
|---|---|
| 13. In Article 70(1), point (h) is deleted. | deleted |
Or. en
Amendment 1323
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 13
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point h
| Text proposed by the Commission | Amendment |
|---|---|
| 13. In Article 70(1), point (h) is deleted. | deleted |
Or. en
Amendment 1324
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 13
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point h
| Text proposed by the Commission | Amendment |
|---|---|
| 13. In Article 70(1), point (h) is deleted. | deleted |
Or. en
Amendment 1325
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 14
Regulation (EU) 2016/679
Article 70 – paragraph 1 – points ha, hb, hc
| Text proposed by the Commission | Amendment |
|---|---|
| 14. In Article 70(1), the following points are inserted: | deleted |
| ‘(ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35. | |
| (hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35. | |
| (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33’ |
Or. en
Amendment 1326
Oliver Schenk, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig, François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 14
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point ha
| Text proposed by the Commission | Amendment |
|---|---|
| (ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35. | (ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article |
| establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment, pursuant to Article 35. |
Or. en
Amendment 1327
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 14
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point ha
| Text proposed by the Commission | Amendment |
|---|---|
| (ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35. | (ha) establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35. |
Or. en
Amendment 1328
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 14
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point ha
| Text proposed by the Commission | Amendment |
|---|---|
| (ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35. | (ha) establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and a list of processing operations for which no data protection impact assessment is required, pursuant to Article 35. |
Or. en
Amendment 1329
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 14
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hb
| Text proposed by the Commission | Amendment |
|---|---|
| (hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35. | (hb) establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35. |
Or. en
Amendment 1330
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 14
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hb
| Text proposed by the Commission | Amendment |
|---|---|
| (hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35. | (hb) establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35. |
Or. en
Amendment 1331
Oliver Schenk, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig, François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 14
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hb
| Text proposed by the Commission | Amendment |
|---|---|
| (hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35. | (hb) establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35. |
Or. en
Amendment 1332
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 14
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc
| Text proposed by the Commission | Amendment |
|---|---|
| (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33 | (hc) establish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33, a list of the circumstances in which it is not likely to result in a high risk, and a list of the circumstances in which it is not likely to result in any risk. |
Or. en
Amendment 1333
Henrik Dahl
Proposal for a regulation
Article 3 – paragraph 1 – point 14
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc
| Text proposed by the Commission | Amendment |
|---|---|
| (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33 | (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33 and a list of the circumstances in which it is not likely to result in a high risk. |
Or. en
Amendment 1334
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 14
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc
| Text proposed by the Commission | Amendment |
|---|---|
| (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33 | (hc) establish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33 |
Or. en
Amendment 1335
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 14
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc
| Text proposed by the Commission | Amendment |
|---|---|
| (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33 | (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely and not likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33 |
Or. en
Amendment 1336
Oliver Schenk, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig
Proposal for a regulation
Article 3 – paragraph 1 – point 14
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc
| Text proposed by the Commission | Amendment |
|---|---|
| (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33 | (hc) establish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33 |
Or. en
Amendment 1337
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 14
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc
| Text proposed by the Commission | Amendment |
|---|---|
| (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33 | (hc) establish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33 |
Or. en
Amendment 1338
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 14
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hc
| Text proposed by the Commission | Amendment |
|---|---|
| (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33 | (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for lists of the circumstances in which a personal data breach is likely to result in a risk to the rights and freedoms of a natural person pursuant to Article 33 |
Or. en
Justification
To include both a white and a black list to help companies/contribute to legal certainty and more harmonisation across the EU
Amendment 1339
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 14
Regulation (EU) 2016/679
Article 70 – paragraph 1 – point hca (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (hca) In Article 70, the following point is inserted: | |
| '(hca) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for further specifying the criteria and conditions for lawful processing of electronic communications data pursuant to Article 91b and the protection of information transmitted to, stored in, related to, processed by and collected from users’ terminal equipment pursuant to Article 91c;' |
Or. en
Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
Amendment 1340
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 14
Regulation (EU) 2016/679 (GDPR)
Article 70 – paragraph 1 – point hca (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (hca) In Article 70, the following point is inserted: | |
| '(hca) issue guidelines on the pseudonymisation and anonymisation of personal data, including in the context of the development and operation of AI systems and models, and on the assessment of the residual risk of re-identification, taking into account the means reasonably likely to be used;' |
Or. en
Amendment 1341
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 14 a (new)
Regulation (EU) 2016/679
Article 70 – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| 14a. In Article 77, paragraph 1 is replaced by the following: | |
| 1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. This right to lodge a complaint also applies when the infringing processing of personal data relating to the data subject is imminent or will take place in the near future. |
Or. en
Amendment 1342
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 14 a (new)
Regulation (EU) 2016/679
Article 83 – Paragraph 5 – point ea (new)
| Present text | Amendment |
|---|---|
| 14a. In Article 83(5), the following point is added: | |
| (new) | "'(ea) infringements of the obligations relating to the verification, documentation and demonstration of the lawful origin, lawful processing and lawful making available of personal data collected from a third party, purchased, aggregated, enriched, sold or otherwise made available to third parties for commercial purposes, pursuant to Article 5(2a).'" |
Or. en
(32016R0679)
Amendment 1343
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 14 a (new)
Regulation (EU) 2016/679
Article 70 – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| 14a. In Article 70, paragraph 3 is replaced by the following: | |
| 3. The Board shall forward its opinions, guidelines, recommendations, common templates, lists, common methodologies and best practices to the Commission and to the committee referred to in Article 93 and make them public. |
Or. en
Amendment 1344
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 14 a (new)
Regulation (EU) 2016/679
Article 83 – paragraph 5
| Present text | Amendment |
|---|---|
| 14a. Article 83 paragraph 5 is replaced by the following: | |
| 5. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: | "5. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: |
| (a) the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9; | (a) the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9; |
| (b) the data subjects' rights pursuant to Articles 12 to 22; | (b) the data subjects' rights pursuant to Articles 12 to 22; |
| (c) the transfers of personal data to a recipient in a third country or an international organisation pursuant to Articles 44 to 49; | (c) the transfers of personal data to a recipient in a third country or an international organisation pursuant to Articles 44 to 49; |
| (d) any obligations pursuant to Member State law adopted under Chapter IX; | (d) any obligations pursuant to Member State law adopted under Chapter IX; |
| (e) non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows by the supervisory authority pursuant to Article 58(2) or failure to provide access in violation of Article 58(1). | (e) non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows by the supervisory authority pursuant to Article 58(2) or failure to provide access in violation of Article 58(1). |
| (f) confidentiality of Communications pursuant to Articles 91a, 91b, 91c, 91d and 91e." |
Or. en
(02016R0679-20160504)
Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
Amendment 1345
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 14 a (new)
Regulation (EU) 2016/679
Article 83 – paragraph 5a (new)
| Present text | Amendment |
|---|---|
| 14a. Article 83 is amended by adding the following paragraph 5a: | |
| No equivalent | "5a. By derogation from paragraph 4, 5 and 6, small controllers shall be subject to administrative fines of up to 50 000 EUR." |
Or. en
Justification
RISK-BASED APPROACH #13: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
Amendment 1346
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 14 a (new)
Regulation (EU) 2016/679
Article 83 – paragraph 5 – point ea (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 14a. In Article 83 paragraph 5, the following point ea is added: | |
| " | |
| (ea) non-compliance with Article 88b. | |
| " |
Or. en
Justification
The amendment ensures that Article 88b can be enforced in practice.
Amendment 1347
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 14 b (new)
Regulation (EU) 2016/679
Article 71 – paragraph 2a (new)
| Present text | Amendment |
|---|---|
| 14b. In Article 71, the title is amended and the follow paragraph 2a is added: | |
| Article 71 | "Article 71 |
| Reports | Reports, Data Protection Data Space |
| 2a. The Board ensures public access to supervisory authorities‘ activity reports according to Article 59. The Board establishes a Data Protection Data Space which contains in electrionacally usable format: | |
| a) the reports published according to Paragraph 1 and Article 59; | |
| b) relevant decisions of supervisory authorties in national and cross border cases; | |
| c) statistical informations provided by the supervisory authorities about data breach notifictions and complaints; | |
| d) guidelines an other public available advise to raise awareness and support the coherent application of this Regulation, regardless wether published by the Board or supervisory authorities. | |
| The Commission may adopt, by means of an implementing act, rules which ensures access to the data base for research purposes, guardrails ensuring data protection and professional secrecy, purpose limitation and conditions for the secondary use of the data contained in the Data Protection Data Space." |
Or. en
Justification
INNOVATION PACKAGE #8: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
Amendment 1348
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 14 b (new)
Regulation (EU) 2016/679
Article 79 – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| 14b. In Article 79, paragraph 2 is replaced with the following: | |
| ‘2. Proceedings against a controller, processor or manufacturer shall be brought before the courts of the Member State where the controller, processor or manufacturer has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller, processor or manufacturer is a public authority of a Member State acting in the exercise of its public powers.‘ |
Or. en
(linked to Article 24(4)(new))
Amendment 1349
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 14 b (new)
Regulation (EU) 2016/679
Article 83 – paragraph 9a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 14b. In Article 83, paragraph 9a is added: | |
| " | |
| (9a) Without prejudice to paragraphs 4, 5 or 6 or Member States law, supervisory authorities shall in any case confiscate all profits made from an infringement of this Regulation by large controllers. | |
| " |
Or. en
Justification
Certain industry sectors, such as social media companies, primary make their revenue from the unlawful processing of personal data. In such cases, where almost 100% of the profits are made from unlawful processing, the 4% fine under Article 83 is not sufficient as a deterrent, but amounts more to a tax for unlawful actions. As in many other laws, the requirement to confiscate unlawful profits shall be added to ensure fair competition and efficient enforcement.
Amendment 1350
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 14 b (new)
Regulation (EU) 2016/679
Article 84 – paragraph 1
| Present text | Amendment |
|---|---|
| 14b. Article 84(1) is replaced by the following: | |
| 1. Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. Such penalties shall be effective, proportionate and dissuasive. | "1. Member States shall lay down the rules on other penalties, including criminal sanctions where appropriate, applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. Such penalties shall be effective, proportionate and dissuasive." |
Or. en
(02016R0679-20160504)
Amendment 1351
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 14 c (new)
Regulation (EU) 2016/679
Article 82 – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| 14c. In Article 82, paragraph 5 is replaced by the following: | |
| '5. Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing of from the manufacturers that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2.' |
Or. en
Justification
linked to Article 24(4) (new)
Amendment 1352
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 14 c (new)
Regulation (EU) 2016/679
Article 77 – paragraph 2
| Present text | Amendment |
|---|---|
| 14c. In Article 77, paragraph 2 is replaced by the following: | |
| 2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78. | "2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78. Where the controller has appointed a data protection officer in accordance with Article 37, a complaint to the supervisory authority shall be admissible only if the data subject has previously lodged the complaint with the controller or the processor and the latter has not addressed the complaint, or has not fully addressed it, within one month of receiving the complaint." |
Or. en
Justification
DPO Package #4: The amendment strengthens accountability by recognising DPOs as practical governance safeguards and first points of contact for complaints. DPOs already advise controllers and processors, monitor compliance and support data subjects; giving them an explicit complaint-handling role makes resolution faster, less bureaucratic and closer to the facts. Voluntary or shared DPOs are encouraged. Supervisory authorities remain available where the complaint is not addressed or not fully remedied within one month.
Amendment 1353
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 14 d (new)
Regulation (EU) 2016/679
Article 80 – paragraphs 1 and 2
| Present text | Amendment |
|---|---|
| 14d. In Article 80, paragraphs 1 and 2 are replaced by the following: | |
| Article 80 | "Article 80 |
| Representation of data subjects | Representation of data subjects |
| 1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law. | 1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77 and 78 and the right referred to in Article 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law, with the exception of the right to claim compensation and liability under Article 82. |
| 2. Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject's mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing. | 2. Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject's mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the right referred to in Article 78 and 79, with the exception of the right to claim compensation and liability under Article 82, if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing." |
Or. en
(Regulation (EU) 2016/679)
Justification
The amendment preserves representative complaints and judicial remedies while clarifying that compensation under Article 82 remains a personal claim requiring proven damage. Non-material damage should be compensable where the infringement causes a significant impairment, ensuring effective redress without turning minor or purely formal infringements into mass claims. This protects data subjects’ individual rights, legal certainty for controllers and processors, and a proportionate balance between enforcement and liability.
Amendment 1354
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 14 d (new)
Regulation (EU) 2016/679
Article 82 – paragraph 6a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 14d. 14c. In Article 82, the following paragraph 6a is added: | |
| ‘6a. Where damage is caused wholly or partly by an act or omission of a manufacturer, the manufacturer shall be liable to the data subject in addition to the controller or processor.’ |
Or. en
Amendment 1355
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 14 e (new)
Regulation (EU) 2016/679
Article 83 – paragraph 5 – point ea (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 14e. In Article 83, paragraph 5, the following point ea is added: | |
| '(ea) obligations related to automated and machine-readable signals of data subject’s choices with respect to processing of personal data in the terminal equipment pursuant to Article 88b;' |
Or. en
Amendment 1356
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 14 e (new)
Regulation (EU) 2016/679
Article 82
| Present text | Amendment |
|---|---|
| 14e. In Article 82, the first paragraph is replaced by the following: | |
| Article 82 | "Article 82 |
| Right to compensation and liability | Right to compensation and liability |
| 1. Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered. | 1. Any data subject who has suffered proven material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered. A claim for compensation for non-material damage arises only in the event of a significant impairment." |
Or. en
(Regulation (EU) 2016/679)
Justification
The amendment preserves representative complaints and judicial remedies while clarifying that compensation under Article 82 remains a personal claim requiring proven damage. Non-material damage should be compensable where the infringement causes a significant impairment, ensuring effective redress without turning minor or purely formal infringements into mass claims. This protects data subjects’ individual rights, legal certainty for controllers and processors, and a proportionate balance between enforcement and liability.
Amendment 1357
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 14 f (new)
Regulation (EU) 2016/679
Article 70 – paragraphs 4a, 4b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 14f. In Article 70, paragraphs 4a and 4b are added: | |
| "4a. In fullfilling ist tasks the Board takes into account that the right to the protection of personal data is not an absolute right and must be considered in relation to its function in society and balanced against other fundamental rights, in accordance with the principle of proportionality. The Board must have inter alia regard of the following as far as relevant in the specific circumstances: | |
| (a) the desirability of promoting innovation; | |
| (b) the desirability of promoting competition; | |
| (c) the importance of the prevention, investigation, detection and prosecution of criminal offences; | |
| (d) the need to safeguard public security and national security; | |
| (e) the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing. | |
| 4b. The Board shall establish a permanent panel of stakeholder representatives to ensure that it fulfills its tasks, especially regarding the matters described in paragraph 5 duely and monitor relevant developments, insofar as they have an impact on the protection of personal data and the free flow of personal dada, in particular the development of information and communication technologies and commercial practices. The Commission may adopt, by means of an implementing act, rules for the appointement and the statue oft he members oft he panel and procedural requirements which ensure professional secrecy and transparency. " |
Or. en
Justification
INNOVATION PACKAGE #8: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.
Amendment 1358
Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Articles 88a, 88b, 88c
| Text proposed by the Commission | Amendment |
|---|---|
| 15. [...] | deleted |
Or. en
Justification
Articles 88a and 88b amended and moved as new articles 91c and 91e under Chapter IXa.Article 88c is deleted.
Amendment 1359
João Oliveira
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Articles 88a, 88b, 88c
| Text proposed by the Commission | Amendment |
|---|---|
| [...] | deleted |
Or. pt
Amendment 1360
Sibylle Berg
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88a | deleted |
Or. de
Justification
Deletion applies to all of Article 88a (paragraphs 1-5).
Amendment 1361
Sebastian Tynkkynen, Diego Solier
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88a | deleted |
Or. en
Amendment 1362
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88a | deleted |
Or. en
Amendment 1363
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2026/679
Article 88a
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88a | deleted |
Or. en
Justification
Deletion of new article 88a
Amendment 1364
Pernando Barrena Arza, João Oliveira
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88a | deleted |
Or. en
Amendment 1365
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88a | deleted |
| (The deletion applies to the whole Article 88a.) |
Or. en
Justification
Article 88a moved back to the ePrivacy Directive
Amendment 1366
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88a | deleted |
Or. en
Amendment 1367
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88
| Text proposed by the Commission | Amendment |
|---|---|
| Processing of personal data in the terminal equipment of natural persons | deleted |
Or. en
Amendment 1368
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulations (EU) 2016/679
Article 88a – title
| Text proposed by the Commission | Amendment |
|---|---|
| Processing of personal data in the terminal equipment of natural persons | Processing of personal data in terminal equipment |
Or. en
Amendment 1369
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation. | deleted |
Or. en
Amendment 1370
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Angelika Niebler, Andrea Wechsler, Oliver Schenk, Pekka Toveri, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation. | (1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject, and any subsequent processing necessary to achieve the purpose for which the data subject has given consent is only allowed when that person has given his or her consent, in accordance with this Regulation. |
Or. en
Amendment 1371
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation. | (1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person shall be lawful where such processing is carried out in accordance with this Regulation and on the basis of Article 6 of this Regulation. |
Or. en
Amendment 1372
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is only allowed when that person has given his or her consent, in accordance with this Regulation. | (1) Storing of personal data, or gaining of access to personal data already stored, in a terminal equipment, and subsequent processing is only allowed when that person has given consent, in accordance with this Regulation. |
Or. en
Amendment 1373
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 1a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1a) In Article 88a, the following paragraph 1a is inserted: | |
| '1a. A data subject shall not be denied access to a service or to a functionality of a service on the grounds that the data subject has not given consent under paragraph 1 to the storing of, or gaining of access to, personal data in a terminal equipment that is not strictly necessary for the provision of that service or functionality.' |
Or. en
Amendment 1374
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1). | deleted |
Or. en
Amendment 1375
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1). | deleted |
Or. en
Amendment 1376
Ana Vasconcelos, João Cotrim De Figueiredo
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1). | (2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1), provided that any such measure is necessary and proportionate and does not require the general identification of users, nor the weakening of anonymity, encryption or other protective tools on which users, including journalists, activists and other persons at risk, rely. |
Or. en
Amendment 1377
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679 (GDPR)
Article 88a – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1). | (2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6 and, where applicable, Article 9, including applicable obligations of professional secrecy to safeguard the objectives referred to in Article 23(1). |
Or. en
Amendment 1378
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1). | (2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in a terminal equipment, and subsequent processing, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6(3), to safeguard the objectives referred to in Article 23(1). |
Or. en
Amendment 1379
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Angelika Niebler, Oliver Schenk, Juan Ignacio Zoido Álvarez, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1). | (2) Paragraph 1 does not preclude storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject, based on Union or Member State law within the meaning of, and subject to the conditions of Article 6, to safeguard the objectives referred to in Article 23(1). |
Or. en
Amendment 1380
Mary Khan
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 2 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| In Article 88a, the following paragraph 2a is inserted: | |
| ‘(2a) This Article shall not be interpreted as a legal basis for accessing the content of electronic communications, for weakening, circumventing or preventing end-to-end encryption, for client-side scanning, for covert access to terminal equipment, for device fingerprinting or for cross-service tracking of natural persons. The confidentiality of communications and the protection of terminal equipment under Directive 2002/58/EC shall remain unaffected. Measures taken pursuant to Article 23 of this Regulation shall be determined by law, necessary and proportionate and, where there is significant infringement of fundamental rights, subject to prior independent judicial review.’ |
Or. de
Justification
Secure communication is a civil right. The rules governing terminal devices and cookies must never create a back door for content control or for making encryption technically weaker.
Amendment 1381
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following: | deleted |
| (a) carrying out the transmission of an electronic communication over an electronic communications network; | |
| (b) providing a service explicitly requested by the data subject; | |
| (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; | |
| (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service. |
Or. en
Amendment 1382
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following: | (3) Storing of personal data, or gaining of access to personal data already stored, in a terminal equipment without consent, and subsequent processing, shall solely be lawful to the extent it is strictly necessary for any of the following purposes: |
Or. en
Amendment 1383
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Angelika Niebler, Oliver Schenk, Pekka Toveri, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following: | (3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following: |
Or. en
Amendment 1384
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful to the extent it is necessary for any of the following: | (3) Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person without consent, and subsequent processing, shall be lawful for any of the following: |
Or. en
Amendment 1385
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point aa (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (aa) In Article 88a, paragraph 3, the following point aa is inserted: | |
| '(aa) enabling contextual advertising to the user, and related purposes which support contextual advertising, which is not based on any type of profiling.' |
Or. en
Amendment 1386
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) providing a service explicitly requested by the data subject; | (b) providing a service explicitly requested by the data subject, where the personal data processed remains strictly limited to what is necessary for the provision of a specific an identifiable service; |
Or. en
Amendment 1387
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Angelika Niebler, Adina Vălean, Henrik Dahl, Oliver Schenk, Pekka Toveri, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) providing a service explicitly requested by the data subject; | (b) providing a service or the maintenance of a user session explicitly requested by the data subject; |
Or. en
Amendment 1388
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point ba
| Text proposed by the Commission | Amendment |
|---|---|
| (ba) In Article 88a, paragraph 3, the following point ba is inserted: | |
| '(ba) the prevention and detection of fraud, provided that the controller can demonstrate that the data are processed exclusively for that purpose, are not used for any other commercial purpose, and are not made available to third parties for purposes other than the prevention and detection of fraud.' |
Or. en
Amendment 1389
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; | deleted |
Or. en
Amendment 1390
Angelika Niebler, Monika Hohlmeier
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; | (c) measuring the audience of an online service in order to draw aggregated information about the usage of an online service to measure the audience of such a service, as defined by article 2 (16) of Regulation 2024/1083, where it is carried out by the controller of that online service solely for its own use or by entitled third parties jointly authorised by advertisers and publishers, solely for the measurement of the overall market performance and subject to the safeguards laid down in Article 89(1); |
Or. en
Amendment 1391
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; | (c) Immediately creating anonymous aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use and does not enable the identification, tracking or profiling of data subjects; |
Or. en
Amendment 1392
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; | (c) creating aggregated, anonymised information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use, provided that such information is not further processed for another purpose; |
Or. en
Amendment 1393
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Paulo Cunha, Angelika Niebler, Pekka Toveri, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; | (c) creating information about the usage of an online service solely for the use of the provider of that service; |
Or. en
Amendment 1394
Oliver Schenk, François-Xavier Bellamy, Dimitris Tsiodras, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; | (c) (c) creating information about the usage of an online service to measure the audience of such a service, where it is carried out at the direction of the controller of that online service, or by a third party acting on behalf of the controller; |
Or. en
Amendment 1395
Wouter Beke
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; | (c) measure the audience as defined in article 2(16) of Regulation 2024/1083, where it is carried out by the provider of that online service, or by a joint controller or processor mandated by the provider of that online service; |
Or. en
Justification
This amendment ensures legal clarity by aligning the text with the EMFA definition of audience measurement and allowing mandated joint controllers or processors to carry it out. This safeguards independent, comparable and verifiable measurement, while enabling the use of aggregated market statistics for transparency and fair competition.
Amendment 1396
Letizia Moratti, Massimiliano Salini, Fulvio Martusciello
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use; | (c) measuring the audience of an online service, where it is carried out by the controller of that online service solely for its own use, or by a third party acting on behalf of the controller; |
Or. en
Amendment 1397
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Paulo Cunha, Angelika Niebler, Adina Vălean, Oliver Schenk, Pekka Toveri, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point ca (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ca) In Article 83, paragraph 3, the following point ca is inserted: | |
| '(ca) performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083.' |
Or. en
Amendment 1398
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Paulo Cunha, Angelika Niebler, Adina Vălean, Pekka Toveri, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point d
| Text proposed by the Commission | Amendment |
|---|---|
| (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service. | (d) maintaining or restoring the security, integrity and functioning of a service provided by the controller and requested by the data subject or the security of the terminal equipment used for the provision of such service, including detecting, preventing or mitigating fraud, automated or non-human traffic, unauthorised access, misuse of the service, circumvention of technical access conditions, or other uses that are contrary to the provider’s terms and conditions |
Or. en
Amendment 1399
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point d
| Text proposed by the Commission | Amendment |
|---|---|
| (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service. | (d) maintaining, restoring or ensuring the technical security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service, including in particular cybersecurity, the protection of personal data and privacy of the user and prevention of fraud and unauthorised access provided that such measures do not override the fundamental rights and interests of the subscriber or user; |
Or. en
Amendment 1400
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point d
| Text proposed by the Commission | Amendment |
|---|---|
| (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service. | (d) demonstrably and proportionally maintaining or restoring the technical security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service. |
Or. en
Amendment 1401
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point d
| Text proposed by the Commission | Amendment |
|---|---|
| (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service. | (d) maintaining or restoring the security and integrity of a service provided by the controller, including fraud prevention or technical incidents, of the terminal equipment used for the provision of such service. |
Or. en
Amendment 1402
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point d
| Text proposed by the Commission | Amendment |
|---|---|
| (d) maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service. | (d) maintaining or restoring the integrity and security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service. |
Or. en
Amendment 1403
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (da) In Article 88a, paragraph 3, the following point da is added: | |
| '(da) contextual advertising and related limitation of advertisement display, audience measurement and preventing fraudulent misrepresentation of audience, unless at least one of the following applies: | |
| (i) the processing is likely to result in a risk to the rights and freedoms of natural persons; | |
| (ii) the processing involves profiling; | |
| (iii) personal data are stored at the time when the electronic communication service is not actively used; | |
| (iv) personal data are connected with past or future activity of the data subject.' |
Or. en
Amendment 1404
Ondřej Krutílek
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (da) In Article 88a, paragraph 3, the following point da is added: | |
| '(da) contextual advertising and related limitation of advertisement display, audience measurement and preventing fraudulent misrepresentation of audience, unless at least one of the following applies: | |
| (i) the processing is likely to result in a risk to the rights and freedoms of natural persons; | |
| (ii) the processing involves profiling; | |
| (iii) personal data are stored at the time when the electronic communication service is not actively used; | |
| (iv) personal data are connected with past or future activity of the data subject. ‘ |
Or. en
Justification
New exemptions are suggested concerning activities that are not based on profiling, i.e. covering low‑risk to the rights and freedoms, non‑profiling activities that do not involve any retention of personal data beyond the user’s active session nor any link to past or future behaviour. This suggestion is inspired by the EDPB/EDPS joint opinion aimed to to create incentives to use less‑intrusive forms of online advertising and to make the rules more proportionate, i.e. allowing some forms of targeted advertising, which is crucial for European publishers and service providers.
Amendment 1405
Oliver Schenk, Dimitris Tsiodras, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig, Aura Salla
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (da) In Article 88a, paragraph 3, the following point da is added: | |
| '(da) ‘legitimate interests’ according to Article 6(1)(f) of this regulation provided that the controller applies Privacy Enhancing Technologies (PETs) in accordance with the technical standards adopted pursuant to Article 25a. This point shall not apply to processing operations that involve tracking or profiling a data subject's behaviour for the purposes of behavioural advertising, where the advertising itself is directly generating revenue for the controller, or where there is no direct relationship with the data subject.' |
Or. en
Amendment 1406
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Paulo Cunha, Angelika Niebler, Adina Vălean, Oliver Schenk, Pekka Toveri, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (da) In Article 88a, paragraph 3, the following point da is added: | |
| '(da) legitimate purposes in relation to contextual advertising, including measuring the performance and reach of such advertisement or capping the frequency with which such advertisement is being displayed.' |
Or. en
Amendment 1407
Ana Vasconcelos, João Cotrim De Figueiredo
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| (da) In Article 88a, paragraph 3, the following sentence is added: | |
| 'The purposes listed in this paragraph shall be interpreted narrowly and shall not serve as a basis for tracking, profiling or the large-scale monitoring of the online activity of data subjects.' |
Or. en
Amendment 1408
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (da) In Article 88a, paragraph 3, the following point da is added: | |
| '(da) processing where the controller deploys recognised Privacy Enhancing Technologies (PETs) that effectively mitigate risks associated to the processing of personal data.' |
Or. en
Amendment 1409
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point da (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (da) In Article 88a, paragraph 3, the following point da is added: | |
| '(da) carrying out operations to detect, prevent or mitigate fraud and money laundering, as well as to combat the financing of terrorism;' |
Or. en
Amendment 1410
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Paulo Cunha, Angelika Niebler, Adina Vălean, Oliver Schenk, Marie-Sophie Lanig, Pekka Toveri, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point db
| Text proposed by the Commission | Amendment |
|---|---|
| (db) In Article 88a, paragraph 3, the following point db is added: | |
| '(db) ‘legitimate interests’ according to Article 6(1)(f) of this regulation provided that the controller applies Privacy Enhancing Technologies (PETs) in accordance with the technical standards adopted pursuant to Article 25a. This point shall not apply to processing operations that involve tracking or profiling a data subject's behaviour for the purposes of behavioural advertising, regardless of whether there is a direct relationship with the data subject. This does not preclude the processing of data for internal product optimisation, provided such processing is not used to track the user.' |
Or. en
Amendment 1411
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point db (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (db) In Article 88a, paragraph 3, the following point db is inserted: | |
| '(db) processing where the controller deploys recognised privacy-enhancing technologies (PETs) that effectively mitigate risks to the rights and freedoms of data subjects, in accordance with the technical specifications adopted pursuant to paragraph 4, 5 and 6;' |
Or. en
Amendment 1412
Oliver Schenk, François-Xavier Bellamy, Dimitris Tsiodras, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig, Aura Salla
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3 – point db (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (db) In Article 88a, paragraph 3, the following point db is added: | |
| '(db) performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083.' |
Or. en
Amendment 1413
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3– point dc (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (dc) In Article 88a, paragraph 3, the following point dc is added: | |
| '(dc) For the purpose of Article 88a paragraph (3)(e), the Commission shall: | |
| (i) assess the state of the art of available technologies; | |
| (ii) develop criteria to assess the effectiveness of risk mitigation in relation to the specific categories of data and processing operations.' |
Or. en
Amendment 1414
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – Paragraph 3a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (3a) In Article 88a, the following paragraph 3a is added: | |
| '3a. Paragraph 3 shall not apply to behavioural or personalised advertising, profiling, customer segmentation, or the inference of health status or other special categories of personal data. Processing for those purposes shall require the data subject’s consent. |
Or. en
Amendment 1415
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 3a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (3a) In Article 88a, the following paragraph 3a is added: | |
| '3a. For any other purpose than those referred to in the second subparagraph, the processing shall comply with Article 6 and, where applicable, with Article 9.' |
Or. en
Amendment 1416
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/579
Article 88a – Paragraph 3b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (3b) In Article 88a, the following paragraph 3b is added: | |
| '3b. The storing of information, or the gaining of access to information already stored, in the terminal equipment of a user or subscriber pursuant to this Article shall be without prejudice to Directive 2002/58/EC, which shall continue to apply in full. In particular, this Article shall not affect the confidentiality of communications and of the related traffic data, the protection of traffic and location data, the safeguards against unsolicited communications, and the possibility for Member States to adopt restrictive measures, as provided for in Articles 5, 6, 9, 13 and 15(1) of that Directive.' |
Or. en
Justification
The storing of, or access to, information in terminal equipment pursuant to Article 88a is without prejudice to Directive 2002/58/EC, which continues to apply in full, and in particular to the confidentiality of communications and of the related traffic data, the protection of traffic and location data, the safeguards against unsolicited communications, and the powers of Member States under Article 15(1). Without this clause, the transfer of the terminal regime to the GDPR could be read as an implicit repeal of the ePrivacy protections which survive it.
Amendment 1417
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/579
Article 88a – Paragraph 3c (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (3c) In Article 88a, the following paragraph 3c is added: | |
| '3c. In particular, information relating to other natural persons stored in the terminal equipment of a user or subscriber, such as contact details, constitutes personal data of those persons. Consent given by the user or subscriber to the storing of, or access to, such information shall not constitute consent by the natural persons to whom that information relates, nor a legal basis for any further processing of their personal data. Such information shall not be transmitted to third parties, nor used for purposes other than those strictly necessary for the service explicitly requested by the user or subscriber.' |
Or. en
Justification
Information relating to other natural persons stored in the terminal equipment of a user, such as contact details, constitutes personal data of those persons. Consent given by the user does not constitute consent by the persons to whom that information relates, nor a legal basis for any further processing of their data. Such information may not be transmitted to third parties nor used for purposes other than those strictly necessary for the service explicitly requested.
Amendment 1418
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – Paragraph 3d (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (3d) In Article 88a, the following paragraph 3d is added: | |
| '3d. This Article shall be without prejudice to the right of data subjects to receive compensation for material or non-material damage resulting from the storing of information, or the gaining of access to information already stored, in their terminal equipment pursuant to this Article, and to the liability of controllers and processors for such processing.' |
Or. en
Amendment 1419
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88 – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: | deleted |
| (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; | |
| (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; | |
| (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. | |
| This paragraph also applies to the subsequent processing of personal data based on consent. |
Or. en
Amendment 1420
Angelika Niebler, Monika Hohlmeier
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: | deleted |
| (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; | |
| (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; | |
| (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. | |
| This paragraph also applies to the subsequent processing of personal data based on consent. |
Or. en
Amendment 1421
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: | deleted |
| (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; | |
| (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; | |
| (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. |
Or. en
Amendment 1422
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: | Where storing of personal data, or gaining of access to personal data already stored, in a terminal equipment is based on consent, the following shall apply without processing more personal data in line with Article 11: |
Or. en
Amendment 1423
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – introductory sentence
| Text proposed by the Commission | Amendment |
|---|---|
| Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: | Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following principles shall apply: |
Or. en
Amendment 1424
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Angelika Niebler, Oliver Schenk, Pekka Toveri, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – introductory sentence
| Text proposed by the Commission | Amendment |
|---|---|
| Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person is based on consent, the following shall apply: | Where storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a data subject is based on consent, the following shall apply: |
Or. en
Amendment 1425
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; | deleted |
Or. en
Amendment 1426
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Angelika Niebler, Adina Vălean, Pekka Toveri, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; | (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means, except where the controller is a media service provider as defined in Article 2 (2) of Regulation (EU) 2024/108 |
Or. en
Amendment 1427
Oliver Schenk, François-Xavier Bellamy, Dimitris Tsiodras, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; | (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner, or be presented with the option to decline consent and proceed to a paid alternative; |
Or. en
Amendment 1428
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; | (a) the data subject shall be able to refuse or withdraw requests for consent in an easy and intelligible manner with a single-click button or equivalent means; |
Or. en
Amendment 1429
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) the data subject shall be able to refuse requests for consent in an easy and intelligible manner with a single-click button or equivalent means; | (a) the data subject shall be able to refuse or accept requests for consent in an easy and intelligible manner with a single-click button or equivalent means; |
Or. en
Amendment 1430
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; | deleted |
Or. en
Amendment 1431
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully rely on the consent of the data subject; | (b) if the data subject gives consent, the controller shall not make a new request for consent for the same purpose for the period during which the controller can lawfully or technically rely on the consent of the data subject; |
Or. en
Amendment 1432
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. | deleted |
Or. en
Amendment 1433
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. | deleted |
Or. en
Amendment 1434
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. | (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. Information about declined requests may be stored and accessed lawfully in the terminal equipment provided that such information does not contain personal data nor unique identifiers and is used only for determining when consent was refused. |
Or. en
Amendment 1435
Nadine Morano
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. | (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months unless a substantial change in circumstances, in the purposes of the processing or in the safeguards afforded to the data subject justifies a new request. |
Or. fr
Amendment 1436
Oliver Schenk, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. | (c) Where data subject refuse request for consent presented by media service providers, Media service providers shall be able to offer data subjects an equivalent alternative that is not accompanied by the processing of personal data for audience-based advertising purposes, where appropriate for a reasonable fee. |
Or. en
Amendment 1437
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Angelika Niebler, Adina Vălean, Pekka Toveri, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months. | (c) if the data subject declines a request for consent, the controller shall not make a new request for consent for the same purpose for a period of at least six months, except where the controller is a media service provider as defined in Article 2 (2) of Regulation (EU) 2024/108. |
Or. en
Amendment 1438
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – points a, b, c, d and da, db, dc (new)
| Text proposed by the Commission | Amendment |
|---|---|
| In Article 88a, paragraph 4, points a, b, c, d are replaced by the following: | |
| '(a) Freedom: consent shall be given freely, the data subject having a genuine choice to refuse or withdraw it without detriment, and neither a contract, a service, nor access to its functionalities shall be made conditional on consent to storage or access that is not necessary for that service; | |
| (b) Specificity: consent shall be given separately for each specified, explicit and legitimate purpose, a distinct opt-in being provided for each; | |
| (c) Information: prior to giving consent, the data subject shall be informed, in clear and plain language, of at least the controller's identity, the purpose of each processing operation, the data used, and the right to withdraw consent at any time; | |
| (d) Unambiguity: consent shall be given by a statement or clear affirmative action, silence, inactivity, pre-ticked boxes or mere continued use of a service not constituting consent;' | |
| The following points are added: | |
| (da) Fair design: the interface used to give, refuse or withdraw consent shall be fair and neutral, and shall not give prominence to acceptance over refusal or otherwise impair the data subject's ability to decide freely; | |
| (db) Withdrawal: the data subject shall be able to withdraw consent at any time, as easily and through the same interface as it was given, free of charge and without degradation of the service; | |
| (dc) Demonstrability: the controller shall be able to demonstrate that valid consent was given, retaining no more information than necessary for that purpose.' |
Or. en
Justification
avoid hard-coded consent UX mandates sources guidelines EDPB 05/2020
Amendment 1439
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4 – last subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| This paragraph also applies to the subsequent processing of personal data based on consent. | deleted |
Or. en
Amendment 1440
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (4a) In Article 88a, the following paragraph 4a is inserted: | |
| '4a. The Board shall encourage stakeholders to develop cross-device,, interoperable and ergonomic interfaces that address consent fatigue, while taking into account the economic balance of all the stakeholders concerned, by exploring possibilities such as: | |
| (a) enabling the data subject to refuse requests for consent in an easy and intelligible manner, through a single-click button or equivalent means; | |
| (b) ensuring that, where the data subject gives consent, the controller does not make a new request for consent for the same purpose during the period in which it can lawfully rely on that consent; | |
| (c) ensuring that, where the data subject declines a request for consent, the controller does not make a new request for consent for the same purpose for a reasonable period.' |
Or. en
Amendment 1441
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Angelika Niebler, Adina Vălean, Pekka Toveri, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 4a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (4a) In Article 88a, the following paragraph 4a is inserted: | |
| '4a. Nothing in this Article shall prevent a media service provider from making access to its service conditional on either the data subject's consent to the processing of personal data for one or more specified purposes, or the payment of a reasonable fee for access to an equivalent version that does not involve such processing. Where such is offered, both options shall be presented to the data subject with equal prominence, in plain language and without the use of dark patterns.' |
Or. en
Amendment 1442
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88a – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| (5) This Article shall apply from [OP: please insert the date = 6 months following the date of entry into force of this Regulation] | deleted |
Or. en
Amendment 1443
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88b | deleted |
Or. en
Amendment 1444
Angelika Niebler, Monika Hohlmeier
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88b | deleted |
Or. en
Amendment 1445
Axel Voss
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88b | deleted |
Or. en
Amendment 1446
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88b | deleted |
Or. en
Amendment 1447
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88b | deleted |
Or. en
Amendment 1448
Letizia Moratti, Massimiliano Salini, Fulvio Martusciello
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88b | deleted |
Or. en
Justification
Centralising consent at the browser level risks reinforcing the position of dominant undertakings, in some cases designated as gatekeepers under the Digital Markets Act
Amendment 1449
Sebastian Tynkkynen, Diego Solier
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88b | deleted |
Or. en
Amendment 1450
Henrik Dahl
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88b | deleted |
| (The amendment seeks to delete the whole Article 88b) |
Or. en
Amendment 1451
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – title
| Text proposed by the Commission | Amendment |
|---|---|
| Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons | deleted |
Or. en
Amendment 1452
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b
| Text proposed by the Commission | Amendment |
|---|---|
| Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons | deleted |
Or. en
Amendment 1453
Angelika Niebler, Monika Hohlmeier
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – title
| Text proposed by the Commission | Amendment |
|---|---|
| Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons | deleted |
Or. en
Amendment 1454
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88 b
| Text proposed by the Commission | Amendment |
|---|---|
| Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons | deleted |
Or. en
Amendment 1455
Oliver Schenk, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – title
| Text proposed by the Commission | Amendment |
|---|---|
| Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons | Voluntary automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons |
Or. en
Amendment 1456
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – title
| Text proposed by the Commission | Amendment |
|---|---|
| Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons | Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of data subjects |
Or. en
Amendment 1457
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – title
| Text proposed by the Commission | Amendment |
|---|---|
| Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons | Automated and machine-readable signals of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons |
Or. en
Amendment 1458
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – title
| Text proposed by the Commission | Amendment |
|---|---|
| Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in the terminal equipment of natural persons | Automated and machine-readable indications of data subject’s choices with respect to processing of personal data in terminal equipment |
Or. en
Amendment 1459
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Controllers shall ensure that their online interfaces allow data subjects to: | deleted |
| (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; | |
| (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means. |
Or. en
Amendment 1460
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Controllers shall ensure that their online interfaces allow data subjects to: | deleted |
| (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; | |
| (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means. |
Or. en
Amendment 1461
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Controllers shall ensure that their online interfaces allow data subjects to: | deleted |
| (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; | |
| (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means. |
Or. en
Amendment 1462
Angelika Niebler, Monika Hohlmeier
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Controllers shall ensure that their online interfaces allow data subjects to: | deleted |
| (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; | |
| (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means. |
Or. en
Amendment 1463
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – chapeau
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Controllers shall ensure that their online interfaces allow data subjects to: | (1) Controllers shall ensure that their online interfaces allow data subjects to use automated and machine-readable means to express the following purposes: |
Or. en
Amendment 1464
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – chapeau
| Text proposed by the Commission | Amendment |
|---|---|
| (1) Controllers shall ensure that their online interfaces allow data subjects to: | (1) Controllers shall ensure that their online interfaces allow data subjects to signal, through automated and machine-readable means: |
Or. en
Amendment 1465
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point –a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (-a) In Article 88b, paragraph 1, the folliwing point is inserted: | |
| '(-a) receive at least information according to Articles 7(3), 13 and, if applicable, 14(1)(c) and (d) , enabling a data subject to provide informed consent or object to the data processing though automated and machine-readable means;' |
Or. en
Amendment 1466
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; | deleted |
Or. en
Amendment 1467
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; | deleted |
Or. en
Amendment 1468
Angelika Niebler, Monika Hohlmeier
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; | deleted |
Or. en
Amendment 1469
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; | (a) Give specific consent per controller and per purpose through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; |
Or. en
Amendment 1470
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; | (a) the data subject’s consent for a specific controller and a specified purpose based on actively given consent by them under the conditions for consent laid down in this Regulation; |
Or. en
Justification
Consent needs to be informed and can therefore only be given by the data subject themself for the first time.
Amendment 1471
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; | (a) Give consent for all or some of the purposes requested by controllers provided that the conditions for consent laid down in this Regulation are fulfilled; |
Or. en
Amendment 1472
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) Give consent through automated and machine-readable means, provided that the conditions for consent laid down in this Regulation are fulfilled; | (a) Give, reject and withdraw consent through automated and machine-readable means, provided that such means allow specific and informed choices; |
Or. en
Amendment 1473
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means. | deleted |
Or. en
Amendment 1474
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means. | deleted |
Or. en
Amendment 1475
Angelika Niebler, Monika Hohlmeier
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means. | deleted |
Or. en
Amendment 1476
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means. | (b) the refusal to give a requested consent and the exercise the right to object pursuant to Article 21(1), Article 21(2), and Article 21(5); |
Or. en
Justification
Important to cover all options under Article 21, including the already existing 21(5) on automated exercise of the right to object.
Amendment 1477
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means. | (b) decline a request for consent. |
Or. en
Amendment 1478
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means. | (b) decline a request for consent, exercise the rights to withdraw consent pursuant to Article 7(3) and to object pursuant to Article 21(2) through automated and machine-readable means. |
Or. en
Amendment 1479
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means. | (b) exercise the right to object pursuant to Article 21(2) through automated and machine-readable means. |
Or. en
Amendment 1480
Nadine Morano
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point ba (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ba) In Article 88b, paragraph 1, the following point ba is inserted: | |
| ‘(ba) modify, withdraw or reinstate their consent at any time, and modify their choice concerning the exercise of their right to object, by automated and machine-readable means, under conditions that are as straightforward as those for giving their consent or exercising that right.’ |
Or. fr
Amendment 1481
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point ba (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ba) In Article 88b, paragraph 1, the following point ba is inserted: | |
| '(ba) The data subject shall retain the possibility to give, refuse or withdraw consent for a specific controller or service, and an automated indication shall not preclude the expression of such service-specific choices.' |
Or. en
Amendment 1482
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point ba (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ba) In Article 88b, paragraph 1, the following point ba is inserted: | |
| '(ba) the withdrawal of consent pursuant to Article 7(3);' |
Or. en
Amendment 1483
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point ba (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ba) In Article 88b, paragraph 1, the following point ba is inserted: | |
| '(ba) withdraw consent;' |
Or. en
Amendment 1484
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point bb (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (bc) In Article 88b, paragraph 1, the following point is inserted: | |
| '(bb) exercise their right to object;' |
Or. en
Amendment 1485
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1 – point bc (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (be) In Article 88b, paragraph 1, the following point is added: | |
| '(bc) receive relevant information pursuant to this Regulation to make informed decision.' |
Or. en
Amendment 1486
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1a) In Article 88b, the following paragraph 1a is inserted: | |
| '1a. Controllers such as providers of web browsers, websites, operating systems and applications shall make available the technical means for data subjects to express, through automated and machine-readable indications, their choice to give consent, to decline a request for consent or to exercise the right to object pursuant to Article 21(2). Such means shall be cross-devvice and interoperable, so that a signal expressed at one level, whether, terminal, operating system, browser, application or website, is recognised and given effect at the others, including between different applications and between different terminal devices used by the same data subject, and shall not constitute a single mandatory mechanism. nor be provided in a manner that concentrates the management of consent in a single system or entity. The technical means shall not be designed or operated so as to confer on the provider of a browser, operating system or terminal a preferential position in obtaining, refusing or managing consent.Controllers shall ensure that their online interfaces recognise and give effect to such indications, provided that the conditions for consent laid down in this Regulation are fulfilled.' |
Or. en
Justification
cross-device consent
Amendment 1487
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 1b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (1b) In Article 88b, the following paragraph 1b is inserted: | |
| '1b. Where technically feasible, data subjects shall be able to use automated and machine-readable means to indicate for which AI-related purposes their personal data may or may not be used. Those indications may distinguish between different purposes, including, for example, AI training, fine- tuning, evaluation, safety testing, generation of outputs, personalisation, advertising, profiling, biometric identification, scientific research, or other specified purposes. Controllers shall respect such indications where the relevant processing is based on consent or on Article 6(1)(f), unless Union or Member State law provides otherwise.' |
Or. en
Amendment 1488
Angelika Niebler, Monika Hohlmeier
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1. | deleted |
Or. en
Amendment 1489
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1. | deleted |
Or. en
Amendment 1490
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1. | deleted |
Or. en
Amendment 1491
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1. | deleted |
Or. en
Amendment 1492
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1. | (2) Controllers shall respect the choices made by data subjects or authorized third-party provider of software or agents conveying choices on their behalf in accordance with paragraph 1. Where the data subject or authorized third-party agent acting on their behalf signals a refusal, withdrawal or objection pursuant to paragraph 1, the controler shall not request consent for the same purpose for a least a year. |
Or. en
Amendment 1493
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1. | (2) The signals in accordance with paragraph 1 shall be legally valid and be binding on, and enforceable against, the controller and any other party. Controllers shall not make requests for consent for the same purpose through different means. Controllers shall not override the choice made through automated and machine-readable means unless the data subject explicitly requests it. |
Or. en
Justification
Wording from the EP mandate on the ePrivacy Reform in 2017
Amendment 1494
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Controllers shall respect the choices made by data subjects in accordance with paragraph 1. | (2) Controllers shall disclose the purposes for which they request consent or where a data subject can object through automated and machine-readable means and respect the choices made by data subjects in accordance with paragraph 1 and 6. |
Or. en
Amendment 1495
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 2a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (2a) In Article 88b, the following paragraph is inserted: | |
| '2a. A data subject shall not be denied access to a service or a functionality of that service based on their choices pursuant to paragraph 1, providing that consent is not strictly necessary for the functionality of that service.' |
Or. en
Amendment 1496
Sibylle Berg, Martin Sonneborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service. | deleted |
Or. de
Justification
No exemptions for media services.
Amendment 1497
Mary Khan
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service. | deleted |
Or. de
Amendment 1498
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service. | deleted |
Or. en
Justification
No black/white exemption, but exemption from the need to have consent in the first place in Art. 88a (now moved to ePrivacy) for audience measurement.
Amendment 1499
Angelika Niebler, Monika Hohlmeier
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service. | deleted |
Or. en
Amendment 1500
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service. | deleted |
Or. en
Amendment 1501
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service. | deleted |
Or. en
Amendment 1502
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service. | deleted |
Or. en
Amendment 1503
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service. | deleted |
Or. en
Amendment 1504
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service. | (3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service and comply with Article 6 of Regulation (EU) 2024/1083. Controllers that are media service providers providing news and current affairs content pursuant to Article 6 (3) of Regulation (EU) 2024/1083 shall have the right to have their online interfaces included in recommended choices, such as whitelists, maintained by web browsers and providers of operating systems. |
Or. en
Amendment 1505
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Angelika Niebler, Adina Vălean, Oliver Schenk, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service. | (3) Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service. This exemption extends to all processing carried out by or on behalf of a media service provider in connection with the provision of the media service. |
Or. en
Amendment 1506
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Paulo Cunha, Angelika Niebler, Eva Maydell, Oliver Schenk, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 3a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (3a) In Article 88b, the following paragraph is inserted: | |
| '3a. Where a data subject gives specific consent to a controller pursuant to Article 88a, such consent shall prevail over any conflicting automated or machine-readable indication referred to in paragraph 1.' |
Or. en
Amendment 1507
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. | deleted |
| Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1. |
Or. en
Amendment 1508
Angelika Niebler, Monika Hohlmeier
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. | deleted |
| Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1. |
Or. en
Amendment 1509
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. | deleted |
| Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1. |
Or. en
Amendment 1510
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. | deleted |
Or. en
Amendment 1511
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. | deleted |
Or. en
Amendment 1512
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. | deleted |
Or. en
Amendment 1513
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Angelika Niebler, Adina Vălean, Oliver Schenk, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. | The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. The European standardisation organisations shall, where appropriate, take into account existing international standards developed by international standardisation organisations, as well as emerging technical specifications developed by relevant industry consortia. When drawing up the standardisation mandate, the Commission shall consult the European Data Protection Board and an advisory forum comprising representatives of controllers, data subjects, media service providers, consumer protection organisations, academia and civil society to ensure that standards reflect diverse perspectives and do not create new gatekeepers |
Or. en
Amendment 1514
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. | By [OP: insert the date: 6 months after entry into force of this amending Regulation], the Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to, within one year after receiving the request, draft standards for the interpretation of machine-readable indications of data subjects’ choices. The standards shall allow for the providers of the technical means and controllers to comply with this Article. When preparing the standardisation request, the Commission shall consult the European Data Protection Board and the European Data Protection Supervisor. |
Or. en
Amendment 1515
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. | The Commission may, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. |
| It shall make such a request within 3 months from the coming into force of this regulation for websites and web browsers. The standardization organization shall ensure that consumers and data subjects are represented in the standardization process. |
Or. en
Amendment 1516
Mary Khan
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2026/679
Article 88b – paragraph 4 – first subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. | Technical specifications for machine-readable indications of choices shall be open, royalty-free, interoperable, publicly documented and independently verifiable. They shall be developed with the substantial involvement of the European Data Protection Board, national supervisory authorities, consumer organisations, SMEs and open-source software providers. Compliance with a standard shall not give rise to a presumption that the underlying processing is lawful. |
Or. de
Justification
Machine-readable choices can reduce the number of cookie banners that appear. However, they must not generate blanket, pre-set or platform-derived consent, nor establish a proprietary default setting.
Amendment 1517
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4 – first subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft standards for the interpretation of machine-readable indications of data subjects’ choices. | The Commission shall, in accordance with Article 10(1) of Regulation (EU) 1025/2012, request one or more European standardisation organisations to draft harmonised standards for the technical specifications, interoperable protocols, and interpretation of the automated and machine-readable indications of data subjects’ choices. |
Or. en
Amendment 1518
Mary Khan
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4 – second subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1. | deleted |
Or. de
Amendment 1519
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4 – second subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1. | deleted |
Or. en
Amendment 1520
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4 – second subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1. | deleted |
Or. en
Amendment 1521
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4 – second subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1. | deleted |
Or. en
Amendment 1522
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4 – second subparagraph
| Text proposed by the Commission | Amendment |
|---|---|
| Online interfaces of controllers which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1. | deleted |
Or. en
Justification
Moved to new paragraph 4b to also cover common specifications as per 4a.
Amendment 1523
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (4a) In Article 88b, the following paragraph is inserted: | |
| '4a. The Commission shall adopt implementing acts establishing common specifications for the requirements set out in paragraphs 1 and 2, where the following conditions have been fulfilled one year after the request pursuant to paragraph 4 has been made: | |
| (a) the request pursuant to paragraph 4 has not been accepted by any of the European standardisation organisations; or | |
| (b) the harmonised standards addressing that request are not delivered within the deadline set in paragraph 4 and in accordance with Article 10(1) of Regulation (EU) No 1025/2012; or | |
| (c) the harmonised standards do not comply with the request; and | |
| (d) no reference to harmonised standards covering the requirements referred to in paragraphs 1 and 2 has been published in the Official Journal of the European Union in accordance with Regulation (EU) No 1025/2012.' |
Or. en
Justification
modeled after Article 41 AI Act
Amendment 1524
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 4b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (4b) In Article 88b, the following paragraph is inserted: | |
| '4b. Online interfaces of controllers which are in conformity with harmonised standards or common specifications or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements covered by those standards or parts thereof, set out in paragraph 1.' |
Or. en
Justification
moved here from paragraph 4 last sub-paragraph, so it also covers common specifications as per paragraph 4a (new)
Amendment 1525
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| (5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation]. | deleted |
Or. en
Amendment 1526
Angelika Niebler, Monika Hohlmeier
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| (5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation]. | deleted |
Or. en
Amendment 1527
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| (5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation]. | deleted |
Or. en
Amendment 1528
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| (5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation]. | deleted |
Or. en
Amendment 1529
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| (5) Paragraphs 1 and 2 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation]. | (5) Paragraphs 1 and 2 shall apply 12 months following the publication of the standards or the common specifications pursuant to paragraph 4 or 4a. |
Or. en
Amendment 1530
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 6
| Text proposed by the Commission | Amendment |
|---|---|
| (6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. | deleted |
Or. en
Amendment 1531
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 6
| Text proposed by the Commission | Amendment |
|---|---|
| (6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. | deleted |
Or. en
Amendment 1532
Angelika Niebler, Monika Hohlmeier
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 6
| Text proposed by the Commission | Amendment |
|---|---|
| (6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. | deleted |
Or. en
Amendment 1533
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 6
| Text proposed by the Commission | Amendment |
|---|---|
| (6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. | deleted |
Or. en
Amendment 1534
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 6
| Text proposed by the Commission | Amendment |
|---|---|
| (6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. | (6) Providers of web browsers and operating systems shall: |
| a) provide the technical means to allow data subjects to give their consent, refuse or withdraw a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article; | |
| b) ensure that their technical infrastructure allows authorized third-party software or agent providers to act on behalf of the data subject, while data subjects, upon their first use, shall be prompted to select the use of such software in online interfaces; | |
| c) not restrict, deny or degrade access or functionality to a service for any privacy-enhancing software, such as a Virtual Private Network, automated configurations, browser extensions or other technology designed to protect the confidentiality of their communication or of their terminal equipment, provided that such technologies comply with technical specifications established by the harmonised standards pursuant to paragraph 4; | |
| d) allow data subjects to import recommended choices, such as whitelists, to the technical means allowing choices, while data subjects, upon their first use, shall be prompted to allow an exception for independent media service providers pursuant to paragraph 3. | |
| e) not process the data subject’s choices referred to in paragraph 1 for any other purpose than transmitting the signal to providers of online interfaces, including in relation to software applications operating on that terminal equipment. |
Or. en
Amendment 1535
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 6
| Text proposed by the Commission | Amendment |
|---|---|
| (6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. | (6) Providers of web browsers, applications and operating systems shall provide the technical means to allow data subjects to give their consent for specific controllers and specified purposes, to refuse a request for consent, to withdraw consent, and to exercise the right to object through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. |
| Nothing in this paragraph shall preclude a provider of a web browser, an application, or an operating system from configuring the technical means referred to in this paragraph to convey, by default, a refusal of consent and an exercise of the right to object referred to in point (b) of paragraph 1, in line with the requirements of Article 24(4). |
Or. en
Justification
Necessary to expand the obligation to any software that allows using information society services.
Amendment 1536
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Angelika Niebler, Adina Vălean, Oliver Schenk, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 6
| Text proposed by the Commission | Amendment |
|---|---|
| (6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. | (6) Rules set out in this Regulation should support the emergence of market-driven solutions with appropriate interfaces that provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article ,and shall provide the technical means to allow media service providers to effectively use the exception pursuant to paragraph 3, as applied pursuant to paragraphs 2 to 5 of this article. The technical means should allow for granular choices, including category-based or purpose-based preferences, and shall enable data subjects to override global settings at the service level. |
Or. en
Amendment 1537
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 6
| Text proposed by the Commission | Amendment |
|---|---|
| (6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. | (6) Providers of web browsers, which are not SMEs, shall make available, without imposing them by default, the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. This paragraph is without prejudice to the possibility for controllers to obtain explicit consent by other means and shall be applied in accordance with the principle of technological neutrality. |
Or. en
Amendment 1538
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 6
| Text proposed by the Commission | Amendment |
|---|---|
| (6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. | (6) Providers of software to access online interfaces shall provide third-party consent management software to manage the choices referred to in paragraph 1 on behalf of data subjects within 3 months of any standard under paragraph 4 being adopted. Third-party consent management software shall not have any commercial interest in the choices of the data subject and provide a neutral interface. Automated choices by a consent management software shall be deemed valid under this Regulation. |
Or. en
Amendment 1539
Sibylle Berg, Martin Sonneborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 6
| Text proposed by the Commission | Amendment |
|---|---|
| (6) Providers of web browsers, which are not SMEs, shall provide the technical means to allow data subjects to give their consent and to refuse a request for consent and exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. | (6) Providers of web browsers and providers of functionally equivalent software, such as operating systems for mobile devices or connected TV devices, shall provide the technical means to allow data subjects to exercise the right to object pursuant to Article 21(2) through the automated and machine-readable means referred to in paragraph 1 of this Article, as applied pursuant to paragraphs 2 to 5 of this Article. |
Or. de
Justification
This is a linguistic clarification to include in the regulation operating systems for mobile devices such as smartphones and tablets, and for smart TVs, which all have functionalities that are similar to those of web browsers.
Amendment 1540
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 6a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (6a) In Article 88b, the following paragraph is inserted: | |
| '6a. Where a provider referred to in paragraph 6 qualifies as a gatekeeper in the meaning of Regulation (EU) 2022/1925, the provider shall enable third-party providers acting structurally and economically independently from it to provide the technical means to convey the data subject's choices referred to in paragraph 1 through the automated and machine-readable means referred to in paragraph 6, as applied pursuant to paragraphs 2 to 5. This paragraph shall not be construed as requiring the provider of a web browser to grant third-party software, including a browser extension, access to data or functionality of the web browser beyond what is necessary to convey to controllers the choices made by data subjects in accordance with paragraph 1.' |
Or. en
Justification
Unbundling for browser, app or operating system providers that qualify as gatekeepers under the Digital Markets Act.
Amendment 1541
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 6b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (6b) In Article 88b, the following paragraph is inserted: | |
| '6b. Providers referred to in paragraph 6, when providing technical means, shall: | |
| (a) ensure that conditions laid down in this Article and Article 5(5) of Directive 2002/58/EC are complied with; | |
| (b) enable the data subject to pick an option to decline requests for consent, object or withdraw consent for specific purposes or all purposes; | |
| (c) enable the data subject to make choices specific to each controller without engaging in any form of differentiated or preferential treatment for specific controllers; | |
| (d) not implement practices that materially distort or impair, either on purpose or in effect, the ability of the data subject to make autonomous and informed choices or decisions; | |
| (e) ensure that controllers can appropriately inform the data subject in accordance with this Regulation, including on the consequences to decline requests for consent or withdraw consent;' |
Or. en
Amendment 1542
Angelika Niebler, Monika Hohlmeier
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 7
| Text proposed by the Commission | Amendment |
|---|---|
| (7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation]. | deleted |
Or. en
Amendment 1543
François-Xavier Bellamy
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 7
| Text proposed by the Commission | Amendment |
|---|---|
| (7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation]. | deleted |
Or. en
Amendment 1544
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 7
| Text proposed by the Commission | Amendment |
|---|---|
| (7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation]. | deleted |
Or. en
Amendment 1545
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 7
| Text proposed by the Commission | Amendment |
|---|---|
| (7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation]. | deleted |
Or. en
Amendment 1546
Tomas Tobé, Arba Kokalari, Jörgen Warborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 7
| Text proposed by the Commission | Amendment |
|---|---|
| (7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation]. | deleted |
Or. en
Amendment 1547
Markéta Gregorová, Damian Boeselager
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 7
| Text proposed by the Commission | Amendment |
|---|---|
| (7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation]. | (7) Paragraph 6 shall apply from [OP: please insert the date = 12 months following publication of the standards or the common specifications pursuant to paragraph 4 and 4a]. |
Or. en
Amendment 1548
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 7
| Text proposed by the Commission | Amendment |
|---|---|
| (7) Paragraph 6 shall apply from [OP: please insert the date = 48 months following the date of entry into force of this Regulation]. | (7) Paragraph 6 shall apply from [OP: please insert the date = 24 months following the date of entry into force of this Regulation]. |
Or. en
Amendment 1549
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Angelika Niebler, Eva Maydell, Oliver Schenk, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 7a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (7a) In Article 88b, the following paragraph is added: | |
| '7a. The Commission shall, by [insert date = 3 years after the date of entry into force of this Regulation], submit a report to the European Parliament and the Council on the functioning of this Article, including an assessment of: | |
| (a) the impact on user choice and competition; | |
| (b) the effectiveness of machine-readable indications in reducing consent fatigue; | |
| (c) the emergence of new gatekeeper risks; | |
| (d) the impact on European media service providers; | |
| and (e) the need for legislative amendment.' |
Or. en
Amendment 1550
Oliver Schenk, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88b – paragraph 7a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (7a) In Article 88b, the following paragrpah is added: | |
| '7a. The Commission shall, by [insert date = 3 years after the date of entry into force of this Regulation], submit a report to the European Parliament and the Council on the functioning of this Article, including an assessment of: | |
| (a) the impact on user choice and competition; | |
| (b) the effectiveness of machine-readable indications in reducing consent fatigue; | |
| (c) the emergence of new gatekeeper risks; | |
| (d) the impact on European media service providers; and | |
| (e) the need for legislative amendment.' |
Or. en
Amendment 1551
Mary Khan
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88c
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88c | deleted |
Or. de
Justification
The AI Act does not create a new legal basis for personal data. The existence of a legitimate interest must be assessed on a case-by-case basis and must not be predetermined by law in favour of AI providers.
Amendment 1552
Sibylle Berg, Martin Sonneborn
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88c
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88c | deleted |
Or. de
Justification
Article 88c is deleted in its entirety.
Amendment 1553
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88c
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88c | deleted |
Or. en
Amendment 1554
Markéta Gregorová
on behalf of the Verts/ALE Group
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88c
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88c | deleted |
Or. en
Amendment 1555
Pernando Barrena Arza
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88c
| Text proposed by the Commission | Amendment |
|---|---|
| Article 88c | Article 88c |
Or. en
Justification
Deletion of the whole article 88c
Amendment 1556
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88c
| Text proposed by the Commission | Amendment |
|---|---|
| Processing in the context of the development and operation of AI | deleted |
Or. en
Amendment 1557
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88c – title
| Text proposed by the Commission | Amendment |
|---|---|
| Processing in the context of the development and operation of AI | Processing in the context of the development and operation of innovative technologies |
Or. en
Justification
Replaces 'artificial intelligence' by 'innovative technologies'. The considerations governing the processing of personal data in the development and operation of AI are not specific to that technology: they apply to any innovative technology involving large-scale processing. Technological neutrality prevents the provision from becoming obsolete with the next technological cycle.
Amendment 1558
Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88c – paragraph 2a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| In Article 88c, the following paragraph is added: | |
| '2a. The development and operation of an AI system or model may constitute, depending on the circumstances, one example of such a legitimate interest pursued by the controller or by a third party within the meaning of point (f) of Article 6(1), without prejudice to other present innovative technologies or future technological use cases. The assessment shall remain technologically neutral and depends on the purpose of the processing, including, as regards AI, the intended purpose within the meaning of Regulation (EU) 2024/1689.' |
Or. en
Amendment 1559
Alex Agius Saliba
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88c – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. | deleted |
Or. en
Amendment 1560
Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88c – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. | (1) Where the processing of personal data is necessary for the development of an AI model Article 6(1)(f) the protection of interests or fundamental rights and freedom of data subject’ require at least: |
| (a) providing data subjects with an absolute right to object to the processing of their personal data after informing the data subject under Article 13(3) or 14(4) about such processing; | |
| (b) ensuring that all personal data is immanently and effectively anonymized, according to state-of-the-art technologies, and only further processed if it is technically impossible to anonymize individual exceptionally remaining personal data; | |
| (c) relevant abstraction during the training phase from any such exceptionally remaining personal data, ensuring that any disclosure of personal data is extremely unlikely; | |
| (d) continuous testing of the AI model to ensure that the disclosure of personal data does not occur and the measures under points (a) to (c) were effective; | |
| (e) ensuring that the controller or any subsequent controller using the AI model can comply with data subject’s rights if any personal data is exceptionally remaining in, processed or disclosed by an AI model. |
Or. en
Amendment 1561
Oliver Schenk, François-Xavier Bellamy, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88c – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. | Where the processing of personal data is necessary for the interests of the controller, or a third party, in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, including a general-purpose AI model as defined in Article 3, point (63) of Regulation (E) 2024/1689, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of this Regulation except where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child and except where other Union explicitly require consent. The processing of personal data in the context of the development and operation of an AI system may also be based for the performance of a task carried out by public authorities in the public interest pursuant to Article 6, paragraph 1, point (e) and paragraph 2. |
Or. en
Amendment 1562
Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Angelika Niebler, Oliver Schenk, Christian Ehler
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88c – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. | Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of this Regulation, except where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child and where other Union laws explicitly require consent. The processing of personal data in the context of the development and operation of an AI system may also be based for the performance of a task carried out by public authorities in the public interest pursuant to Article 6, paragraph 1, point (e) and paragraph 2. |
Or. en
Amendment 1563
Andrea Wechsler, Marie-Sophie Lanig, Stefan Köhler, Alexandra Mehnert, Verena Mertens, Sabine Verheyen
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88c – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. | 1) Where the processing of personal data is necessary for the purposes of the development, training, testing, validation, deployment, operation or monitoring of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or of an AI model, such processing may constitute a legitimate interest within the meaning of Article 6(1), point (f), provided that: (a) the processing is necessary for the interest pursued by the controller or by a third party; (b) that interest is not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, taking particular account of whether the data subject is a child; and (c) no provision of Union or Member State law expressly requires the consent of the data subject for that processing. |
Or. en
Amendment 1564
Krzysztof Hetman, Adam Jarubas
Proposal for a regulation
Article 3 – paragraph 1 – point 15
Regulation (EU) 2016/679
Article 88c – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. | Where the processing of personal data is necessary for the interests of the controller or a third party in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, including a general-purpose AI model as defined in Article 3, point (63) Regulation (EU) 2024/1689 such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, except where other Union explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. |
Or. en