Amendment 1274· GDPR Article 41a(2)(b)
~Alternative
Text of the amendment
As tabled
Wordingagainst the Commission’s
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical or reasonably foreseeable recipients of data, based on costs, amount of time required, available technology, legal powers and restrictions and all other relevant objective factors.
Struck CommissionHighlighted amendment
GDPR Article 41a with this amendment
Amendment 1274 applied to the Commission proposal, no other amendment
Unchanged: (1)
The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.
For the purpose of paragraph 1 the Commission shall:
~AmendedUnchanged: (a)
assess the state of the art of available techniques;
develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical or reasonably foreseeable recipients of data, based on costs, amount of time required, available technology, legal powers and restrictions and all other relevant objective factors.
~AmendedUnchanged: (3), (4) and (5)
The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.
The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.
The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).
Justification
The implementing acts should not directly determine the notion of personal data, they should include the core requirements on the means and criteria. It should be done by introducing the reason for why the data lose the status of personal data in relation to specific entities in para (1) and by adapting point 2(b) to cover the basic factors contributing to risk of re-identification (according to recital 26 GDPR). ‘or reasonably foreseeable’ is added to address risk-based determination of other than typical or intended recipients.
Target
Wording of the targeted provisionlaw in force, Commission proposal, latest Council text
No Council text amends Article 41a(2)(b).
Cite this amendment
Amendment 1274 (Ondřej Krutílek), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1261–1564 to the draft report on COM(2025) 837 (CJ72-AM-791873, PE791.873v01-00, 27 July 2026), pp. 9–10
Link, short form and official text
Amendment 1274 (Ondřej Krutílek), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1261–1564 to the draft report on COM(2025) 837 (CJ72-AM-791873, PE791.873v01-00, 27 July 2026), pp. 9–10
ITRE–LIBE Amendment 1274 (CJ72-AM-791873), p. 9