Amendment 933· GDPR Article 4(5)
~Alternative
Text of the amendment
As tabled
Tracker noteThis amendment moves the Commission’s instruction from point (1) to point (5) and proposes its own wording there. Whether the Commission’s original wording for point (1) would still be added has not been established, so no amended version of the article is shown.
Amending instructionagainst the Commission’s
(a) in point 1 5, the following sentences are added:
Struck CommissionHighlighted amendment
Sentences it would add
Pseudonymisation does not form part of the definition of personal data laid down in point (1).
Personal data which have undergone pseudonymisation and which could be attributed to a natural person by the use of additional information remain personal data for the controller holding that additional information, and cannot as such be regarded as anonymised.
However, where personal data which have undergone pseudonymisation are made available to another entity, they may cease to be personal data in relation to that entity where the technical and organisational measures referred to in the first subparagraph effectively prevent that entity from attributing the data to the data subject, provided that:
(a)that entity is not in a position to circumvent those measures in the course of any processing carried out under its control; and
(b)those measures also prevent that entity from attributing the data to the data subject by other means reasonably likely to be used, including by combination with other information available to it.
Where it cannot be excluded that the data will be further transmitted to third parties reasonably likely to be able to attribute them to the data subject, the data shall be regarded as personal data in respect of that transmission and of any subsequent processing by those third parties.
Justification
Codifies the judgment of the Court of Justice in Case C-413/23 P (EDPS v SRB) at the place where the Court itself situated it. Pseudonymisation does not form part of the definition of personal data (paragraph 72). Pseudonymised data remain personal data for the controller holding the additional information (paragraph 76) and cannot as such be regarded as anonymised (paragraph 73). They may, however, not be regarded as personal data in relation to a recipient where the technical and organisational measures have been effectively implemented and prevent that recipient from attributing the data to the data subject, including by combination with other information, so that the risk of identification is insignificant (paragraphs 75, 77 and 82). Where onward transmission to third parties able to re-identify cannot be excluded, the data remain personal data (paragraph 85).
Target
Wording of the targeted provisionlaw in force, Commission proposal, latest Council text
Law in forceGDPR, Article 4(5)
‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
No Council text amends Article 4(5).
Cite this amendment
Amendment 933 (Julie Rechagneux and others), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 777–1052 to the draft report on COM(2025) 837 (CJ72-AM-791072, PE791.072v01-00, 27 July 2026), pp. 94–95
Link, short form and official text
Amendment 933 (Julie Rechagneux and others), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 777–1052 to the draft report on COM(2025) 837 (CJ72-AM-791072, PE791.072v01-00, 27 July 2026), pp. 94–95
ITRE–LIBE Amendment 933 (CJ72-AM-791072), p. 94