Amendment 1287· GDPR Article 41a(3)
~Alternative
Text of the amendment
As tabled
Wordingagainst the Commission’s
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.In the context of a group of undertakings, data resulting from pseudonymisation shall no longer constitute personal data for an undertaking where:
(a) binding intra-group arrangements and appropriate technical and organisational measures, such as logical segregation and access controls, ensure that the undertaking does not have access, and is not reasonably likely to obtain access, to identification keys or additional identifying information held by another group undertaking prohibit any attempt at re-identification, and ensure that the undertaking does not possess other means reasonably likely to enable the re-identification of data subjects; and
(b) the undertaking is able to demonstrate the effectiveness of such arrangements and measures.
Struck CommissionHighlighted amendment
GDPR Article 41a with this amendment
Amendment 1287 applied to the Commission proposal, no other amendment
Unchanged: (1) and (2)
The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.
For the purpose of paragraph 1 the Commission shall:
assess the state of the art of available techniques;
develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.
The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.In the context of a group of undertakings, data resulting from pseudonymisation shall no longer constitute personal data for an undertaking where:
binding intra-group arrangements and appropriate technical and organisational measures, such as logical segregation and access controls, ensure that the undertaking does not have access, and is not reasonably likely to obtain access, to identification keys or additional identifying information held by another group undertaking prohibit any attempt at re-identification, and ensure that the undertaking does not possess other means reasonably likely to enable the re-identification of data subjects; and (b) the undertaking is able to demonstrate the effectiveness of such arrangements and measures.
+NewUnchanged: (4) and (5)
The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.
The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).
Struck removed Highlighted added Full text on the GDPR Article 41a page
Target
Wording of the targeted provisionlaw in force, Commission proposal, latest Council text
No Council text amends Article 41a(3).
Cite this amendment
Amendment 1287 (Francesco Torselli), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1261–1564 to the draft report on COM(2025) 837 (CJ72-AM-791873, PE791.873v01-00, 27 July 2026), pp. 16–17
Link, short form and official text
Amendment 1287 (Francesco Torselli), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1261–1564 to the draft report on COM(2025) 837 (CJ72-AM-791873, PE791.873v01-00, 27 July 2026), pp. 16–17
ITRE–LIBE Amendment 1287 (CJ72-AM-791873), p. 16