Amendment 394· Digital Omnibus proposal Recital 40a (new)

(40a)Regulation (EU) 2016/679 follows a technology-neutral, risk-based and purpose-driven approach to the processing of personal data. The lawfulness of processing should be determined by reference to a specific and legitimate purpose and an assessment of the risks posed to the rights and freedoms of natural persons, taking into account the nature, scope, context and purposes of the processing. Where personal data are processed through the terminal equipment of natural persons, and the available indicators demonstrate that the likelihood and severity of risks to those rights and freedoms are limited, reliance on legal bases other than consent may be justified, where appropriate.