Amendment 371· Digital Omnibus proposal Recital 38
~Alternative
Text of the amendment
As tabled
Wordingagainst the Commission’s
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing.Article 22(1) confers on the data subject the right not to be subject to such a decision. That right is a prohibition of principle, subject to the limited exceptions laid down in Article 22(2), and not an authorisation subject to conditions. Where the controller relies on the necessity of the decision for entering into, or the performance of, a contract, that necessity shall be interpreted strictly. A decision is not necessary within the meaning of that provision where the purpose pursued can reasonably be achieved by means involving human intervention. The availability of an equally effective non-automated alternative excludes reliance on that exception. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The safeguards laid down in Article 22(3), and in particular the right to obtain human intervention, to express one’s point of view and to contest the decision, apply in full.
Struck CommissionHighlighted amendment
Target
Wording of the targeted provisionlaw in force, Commission proposal, latest Council text
Commission proposalCOM(2025) 837
Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Council text of 22 October 2026ST 14756/26
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Cite this amendment
Amendment 371 (Julie Rechagneux and others), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 251–400 to the draft report on COM(2025) 837 (CJ72-AM-790967, PE790.967v01-00, 27 July 2026), pp. 135–136
Link, short form and official text
Amendment 371 (Julie Rechagneux and others), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 251–400 to the draft report on COM(2025) 837 (CJ72-AM-790967, PE790.967v01-00, 27 July 2026), pp. 135–136
ITRE–LIBE Amendment 371 (CJ72-AM-790967), p. 135