Amendment 216· Digital Omnibus proposal Recital 27

Wordingagainst the Commission’s

(27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given person or entity where that person or entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵Council. It should also be clarified that information, which is apparently impersonal, may still be considered personal data if the data subject can be identified with additional information obtained from another person or entity through means reasonably likely to be used making it possible to identify the data subject. In such circumstances, the fact that the information enabling the data subject to be identified is in the hands of other people does not prevent that data subject from being identifiable for the controller. The Court of Justice of the European Union has also held that information which are in themselves impersonal may become personal in nature where the controller puts them, or is likely to put them, at the disposal of other persons or entities who have means reasonably likely to enable the data subject to be identified. It is apparent, in particular, that if that information is put at these other persons or entities’ disposal – then this information is personal data for these persons and entities and, indirectly, for the controller. Accordingly, in so far as it cannot be ruled out that those persons or entities have means reasonably allowing them to attribute pseudonymised data to the data subject, such as cross-checking with other data at their disposal, the data subject must be regarded as identifiable as regards both that transfer and any subsequent processing of those data by those persons and entities. In such circumstances, pseudonymised data should be considered to be personal data. The Commission, together with the European Data Protection Board, shouldmay support controllers in the application of this updated definition by stipulating technical criteria in an implementing act.

Struck CommissionHighlighted amendment