Amendment 224· Digital Omnibus proposal Recital 27a (new)

(27a)Regulation (EU) 2016/679 already has elements of a risk-based approach. However, especially small and medium enterprises cannot benefit from a risk-based approach if the necessary legal certainty is not provided through clear thresholds. To increase the legal certainty for more limited processing the objective categories for small, medium and large processers is introduced. Small controllers are all controllers that have or will process the data of less than [100.000] data subjects in the pending or preceding financial year, including short-term transactional processing. As a default the current rules in the Regulation are maintained and controllers are deemed a medium controller. A controller may only benefit from the privileges for small controllers if there is positive knowledge about fulfilling the criteria. Controllers like hospitals or Unions that by their very nature process large numbers of sensitive data under Article 9 or 10 of Regulation (EU) 2016/679 shall not be deemed a small controller. While small controllers must not comply with many administrative requirements of the Regulation, the rights of data subjects, which are largely based on Article 8(2) of the Charter are not altered. Given the existing burden of proof of controllers, the lack of formal documentation shall not limit the effective enforcement of data subjects’ rights. In the rare case of a complaint or procedure against a small controller, they may proof compliance with any formal or informal evidence according to national procedural law.