Amendment 1166· GDPR Article 22(4a) (new)
+Addition
Text of the amendment
As tabled
Amending instruction
7a. In Article 22, the following paragraph 4a is added:
Paragraph 4a it would add
Without any prejudice to Article 35, any automated decision making under Article 22(1) of this Regulation that is likely to affect more than 100 data subjects per year shall be subject to a data protection impact assessment performed by the controller.'
GDPR Article 22 with this amendment
Amendment 1166 applied to the Commission proposal, no other amendment
Unchanged: (1), (3) and (4)
A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision:
is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means;
is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or
is based on the data subject’s explicit consent.
In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place.
Without any prejudice to Article 35, any automated decision making under Article 22(1) of this Regulation that is likely to affect more than 100 data subjects per year shall be subject to a data protection impact assessment performed by the controller.'
+NewJustification
Automated individual decision-making under Article 22 GDPR will regularly trigger the obligation to perform a data protection impact assessment under Article 35 GDPR. However, this provision should introduce relatively hard factors triggering this obligation in cases of large-scale processing and processing of sensitive data in order to avoid situations in which a controller considers the requirements under Article 35 not to be met.
Target
Wording of the targeted provisionlaw in force, Commission proposal, latest Council text
No Council text amends Article 22(4a) (new).
Cite this amendment
Amendment 1166 (Pernando Barrena Arza), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1053–1260 to the draft report on COM(2025) 837 (CJ72-AM-791073, PE791.073v01-00, 27 July 2026), pp. 95–96
Link, short form and official text
Amendment 1166 (Pernando Barrena Arza), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1053–1260 to the draft report on COM(2025) 837 (CJ72-AM-791073, PE791.073v01-00, 27 July 2026), pp. 95–96
ITRE–LIBE Amendment 1166 (CJ72-AM-791073), p. 95