Amendment 1253· GDPR Article 41a(1)
~Alternative
Text of the amendment
As tabled
Wordingagainst the Commission’s
(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.The European Data Protection Board (EDPB) shall issue an opinion in accordance with Article 64(2) addressing the application of pseudonymisation and anonymisation, including related technical and organisational measures, to specify the means and criteria to determine whether the application of pseudonymisation and anonymisation to personal data effectively prevents the identification of a data subject and the data subject is not or is no longer identifiable.
Struck CommissionHighlighted amendment
GDPR Article 41a with this amendment
Amendment 1253 applied to the Commission proposal, no other amendment
The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.The European Data Protection Board (EDPB) shall issue an opinion in accordance with Article 64(2) addressing the application of pseudonymisation and anonymisation, including related technical and organisational measures, to specify the means and criteria to determine whether the application of pseudonymisation and anonymisation to personal data effectively prevents the identification of a data subject and the data subject is not or is no longer identifiable.
Unchanged: (2), (3), (4) and (5)
For the purpose of paragraph 1 the Commission shall:
assess the state of the art of available techniques;
develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.
The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.
The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.
The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).
Struck removed Highlighted added Full text on the GDPR Article 41a page
Justification
Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.
Target
Wording of the targeted provisionlaw in force, Commission proposal, latest Council text
No Council text amends Article 41a(1).
Cite this amendment
Amendment 1253 (Michael McNamara and others), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1053–1260 to the draft report on COM(2025) 837 (CJ72-AM-791073, PE791.073v01-00, 27 July 2026), pp. 167–168
Link, short form and official text
Amendment 1253 (Michael McNamara and others), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1053–1260 to the draft report on COM(2025) 837 (CJ72-AM-791073, PE791.073v01-00, 27 July 2026), pp. 167–168
ITRE–LIBE Amendment 1253 (CJ72-AM-791073), p. 167