Amendment 1560· GDPR Article 88c

Wordingagainst the Commission’s

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.(1) Where the processing of personal data is necessary for the development of an AI model Article 6(1)(f) the protection of interests or fundamental rights and freedom of data subject’ require at least: (a) providing data subjects with an absolute right to object to the processing of their personal data after informing the data subject under Article 13(3) or 14(4) about such processing; (b) ensuring that all personal data is immanently and effectively anonymized, according to state-of-the-art technologies, and only further processed if it is technically impossible to anonymize individual exceptionally remaining personal data; (c) relevant abstraction during the training phase from any such exceptionally remaining personal data, ensuring that any disclosure of personal data is extremely unlikely; (d) continuous testing of the AI model to ensure that the disclosure of personal data does not occur and the measures under points (a) to (c) were effective; (e) ensuring that the controller or any subsequent controller using the AI model can comply with data subject’s rights if any personal data is exceptionally remaining in, processed or disclosed by an AI model.

Struck CommissionHighlighted amendment