Amendment 367· Digital Omnibus proposal Recital 38
~Alternative
Text of the amendment
As tabled
Wordingagainst the Commission’s
(38) Article 22 of Regulation (EU) 2016/679 provides forthat data subjects have the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisionswhen assessing whether a decision based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. WhenHowever, when several equally effective automated processing solutions exist, the controller should use the less intrusive one. The data subject’s rights should not suffer due to the implementation of automated individual decision-making. Human involvement with regard to automated decision-making should be meaningful, and a mere symbolic gesture of viewing the decision made by a human without real and factual influence on the decision-making should not be categorised as human involvement. In order to ensure a consistent and high level of protection of natural persons, legal effects and similarly significant effects on the data subject should be interpreted broadly, and include decisions such as payment methods offered to a data subject and prices shown to a data subject when visiting an online retailer.
Struck CommissionHighlighted amendment
Target
Wording of the targeted provisionlaw in force, Commission proposal, latest Council text
Commission proposalCOM(2025) 837
Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Council text of 22 October 2026ST 14756/26
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Cite this amendment
Amendment 367 (Marina Kaljurand and others), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 251–400 to the draft report on COM(2025) 837 (CJ72-AM-790967, PE790.967v01-00, 27 July 2026), pp. 131–132
Link, short form and official text
Amendment 367 (Marina Kaljurand and others), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 251–400 to the draft report on COM(2025) 837 (CJ72-AM-790967, PE790.967v01-00, 27 July 2026), pp. 131–132
ITRE–LIBE Amendment 367 (CJ72-AM-790967), p. 131