Amendment 223· Digital Omnibus proposal Recital 27

Wordingagainst the Commission’s

(27) Regulation (EU) 2016/679 protects natural persons with regard to the processing of personal data. Personal data originate from a natural person and derive their protected character from that origin. Any clarification of the notion of identifiability must therefore preserve the link between the data and the natural person from whom they originate, and may not have the effect of removing from the scope of that Regulation data which relate to a natural person merely because a given entity is not, at a given moment, in a position to identify that person. This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable.The definition of personal data as currently laid down in Regulation (EU) 2016/679 shall not be called into question. Personal data originates from a natural person; whether it remains personal data depends on whether that person is identifiable, the degree of re-identifiability being assessed through the notions of pseudonymous, pseudonymised and anonymised data. The assessment of whether a natural person is identifiable shall be distinguished from the definition of personal data, except for anonymised data, which lose their qualification as personal data. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679.The new specifications introduced by this Regulation apply to the notions of 'pseudonymous' and 'pseudonymisation'. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵ . The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act.

Struck CommissionHighlighted amendment