Amendment 397· GDPR Article 41a(3)
~Alternative
Text of the amendment
As tabled
Wordingagainst the Commission’s
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.The implementation, by a processor, a subcontractor, a data holder or a data recipient, of technical and organisational measures and criteria set out in the guidelines referred to in paragraph [1] may be referred to as an element which makes it possible to demonstrate that data are not, or are no longer, likely to allow the reidentification of the data subjects, and that the data subject has fulfilled his or her obligations, including those relating to the request for consent, under this Regulation. Consideration of these elements shall not affect the assessment of specific circumstances on a case-by-case basis by the competent supervisory authority or the interpretation of Union law by the Court of Justice of the European Union.
Struck CommissionHighlighted amendment
GDPR Article 41a with this amendment
Amendment 397 applied to the Commission proposal, no other amendment
Unchanged: (1) and (2)
The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.
For the purpose of paragraph 1 the Commission shall:
assess the state of the art of available techniques;
develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.
The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.The implementation, by a processor, a subcontractor, a data holder or a data recipient, of technical and organisational measures and criteria set out in the guidelines referred to in paragraph [1] may be referred to as an element which makes it possible to demonstrate that data are not, or are no longer, likely to allow the reidentification of the data subjects, and that the data subject has fulfilled his or her obligations, including those relating to the request for consent, under this Regulation. Consideration of these elements shall not affect the assessment of specific circumstances on a case-by-case basis by the competent supervisory authority or the interpretation of Union law by the Court of Justice of the European Union.
Unchanged: (4) and (5)
The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.
The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).
Struck removed Highlighted added Full text on the GDPR Article 41a page
Target
Wording of the targeted provisionlaw in force, Commission proposal, latest Council text
No Council text amends Article 41a(3).
Cite this amendment
Amendment 397 (Virginie Joron), European Parliament, Committee on the Internal Market and Consumer Protection, amendments 329–532 to the draft opinion on COM(2025) 837 (IMCO-AM-791061, PE791.061v01-00, 16 July 2026), pp. 45–46
Link, short form and official text
Amendment 397 (Virginie Joron), European Parliament, Committee on the Internal Market and Consumer Protection, amendments 329–532 to the draft opinion on COM(2025) 837 (IMCO-AM-791061, PE791.061v01-00, 16 July 2026), pp. 45–46
IMCO Amendment 397 (IMCO-AM-791061), p. 45