Amendment 291· Data Act Article 32f
+Addition
Text of the amendment
As tabled
Wording it would add
5a.Recognised data altruism organisations shall implement appropriate technical and organisational measures to prevent the re-identification of pseudonymised data, personal data breaches, and any unlawful acquisition, use, disclosure or transfer of the data made available to them. Where the data are processed or shared in pseudonymised or anonymised form, they shall apply state-of-the-art techniques for that purpose aimed at preserving and reinforcing privacy protection.
Data Act Article 32f with this amendment
Amendment 291 applied to the Commission proposal, no other amendment
Unchanged: (1), (2), (3), (4) and (5)
Recognised data altruism organisations shall inform data subjects or data holders prior to any processing of their data in a clear and easily comprehensible manner of the following:
the objectives of general interest and, if applicable, the specified, explicit and legitimate purpose for which personal data is to be processed, and for which it permits the processing of their data by a data user;
the location of the processing and the objectives of general interest for which it permits any processing carried out in a third country, where the processing is carried out by the recognised data altruism organisation.
Recognised data altruism organisations shall not use the data for other objectives than the objectives of general interest for which the data subject or data holder allows the processing. The recognised data altruism organisation shall not use misleading marketing practices to solicit the provision of data.
Recognised data altruism organisations shall provide electronic means for obtaining consent from data subjects or permissions to process data made available by data holders as well as for their withdrawal.
Recognised data altruism organisations shall, without delay, inform data holders in the event of any unauthorised transfer, access or use of the non-personal data that it has shared.
Where recognised data altruism organisations facilitate data processing by third parties, including by providing tools for obtaining consent from data subjects or permissions to process data made available by data holders, they shall, where relevant, specify the third-country in which the data use is intended to take place.
Recognised data altruism organisations shall implement appropriate technical and organisational measures to prevent the re-identification of pseudonymised data, personal data breaches, and any unlawful acquisition, use, disclosure or transfer of the data made available to them. Where the data are processed or shared in pseudonymised or anonymised form, they shall apply state-of-the-art techniques for that purpose aimed at preserving and reinforcing privacy protection.
+NewTarget
Wording of the targeted provisionlaw in force, Commission proposal, latest Council text
Commission proposalCOM(2025) 837
Article 32f Duties of recognised data altruism organisations (1) Recognised data altruism organisations shall inform data subjects or data holders prior to any processing of their data in a clear and easily comprehensible manner of the following: (a) the objectives of general interest and, if applicable, the specified, explicit and legitimate purpose for which personal data is to be processed, and for which it permits the processing of their data by a data user; (b) the location of the processing and the objectives of general interest for which it permits any processing carried out in a third country, where the processing is carried out by the recognised data altruism organisation. (2) Recognised data altruism organisations shall not use the data for other objectives than the objectives of general interest for which the data subject or data holder allows the processing. The recognised data altruism organisation shall not use misleading marketing practices to solicit the provision of data. (3) Recognised data altruism organisations shall provide electronic means for obtaining consent from data subjects or permissions to process data made available by data holders as well as for their withdrawal. (4) Recognised data altruism organisations shall, without delay, inform data holders in the event of any unauthorised transfer, access or use of the non-personal data that it has shared. (5) Where recognised data altruism organisations facilitate data processing by third parties, including by providing tools for obtaining consent from data subjects or permissions to process data made available by data holders, they shall, where relevant, specify the third-country in which the data use is intended to take place.
Council text of 22 October 2026ST 14756/26
Article 32f Duties of recognised data altruism organisations (1) Recognised data altruism organisations shall inform data subjects or data holders prior to any processing of their data in a clear and easily comprehensible manner of the following:
(a)the objectives of general interest and, if applicable, the specified, explicit and legitimate purpose for which personal data is to be processed, and for which it permits the processing of their data by a data user;
(b)the location of the processing and the objectives of general interest for which it permits any processing carried out in a third country, where the processing is carried out by the recognised data altruism organisation.
(2)Recognised data altruism organisations shall not use the data for other objectives than the objectives of general interest for which the data subject or data holder allows the processing. The recognised data altruism organisation shall not use misleading marketing practices to solicit the provision of data.
(3)Recognised data altruism organisations shall provide electronic means for obtaining consent from data subjects or permissions to process data made available by data holders as well as for their withdrawal.
(4)Recognised data altruism organisations shall, without delay, inform data holders in the event of any unauthorised transfer, access or use of the non-personal data that it has shared.
(5)Where recognised data altruism organisations facilitate data processing by third parties, including by providing tools for obtaining consent from data subjects or permissions to process data made available by data holders, they shall, where relevant, specify the third-country in which the data use is intended to take place.
Cite this amendment
Amendment 291 (Virginie Joron), European Parliament, Committee on the Internal Market and Consumer Protection, amendments 125–328 to the draft opinion on COM(2025) 837 (IMCO-AM-790905, PE790.905, 16 July 2026), pp. 136–137
Link, short form and official text
Amendment 291 (Virginie Joron), European Parliament, Committee on the Internal Market and Consumer Protection, amendments 125–328 to the draft opinion on COM(2025) 837 (IMCO-AM-790905, PE790.905, 16 July 2026), pp. 136–137
IMCO Amendment 291 (IMCO-AM-790905), p. 136