EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

Digital Omnibus proposal· Recital 27

Analysis in our dossiers
The definition of “personal data”

Text

Recital 27 Digital Omnibus proposal as printed in the Council text of 22 October 2026

Source Council, 22 October 2026. Recital 27: ST 14756/26, page 24 · exact text page

This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection.

How the recitals changed

Each text against the text before it

Recital Commission19 Nov 2025Rec 27Council21 May 2026Rec 27–27bCouncil10 Jun 2026Rec 27–27bCouncil18 Jun 2026Rec 27–27bCouncil3 Sep 2026Rec 27–27cCouncil2 Oct 2026Rec 27–27cCouncil22 Oct 2026Rec 27–27c
Compared withlaw in forcethe proposal21 May text10 Jun text18 Jun text3 Sep text2 Oct text
Recital 27 27 Added 27 Changed keeps only the first sentence 27 Unchanged 27 Unchanged 27 Unchanged 27 Unchanged 27 Unchanged
Recital 27a In neither text 27b Added 27b Unchanged 27b Unchanged 27a Changed 27a Changed 27a Unchanged
Recital 27b In neither text 27a Added 27a Changed 27a Unchanged 27b Changed 27b Changed 27b Unchanged
Recital 27c In neither text In neither text In neither text In neither text 27c Added Wording moved 27c Unchanged 27c Unchanged

Each text against the text before it: +Added in this text, not in the text before~Changed wording changed=Unchanged same as the text before— in neither text

Wording moved the wording comes from a different earlier recital

Parliament amendments propose other recitals under these numbers: Recital 27a (new), Recital 27b (new), Recital 27c (new) and Recital 27d (new).

Parliament amendments

16 amendments to this recital

4 amendments would delete the whole recital: members of The Left, Greens/EFA, EPP and non-attached members.

By political group; co-sponsored amendments count for each group
TypeThe LeftS&DGreens/EFARenewEPPECRPfENIRapporteur
− Deletion1·1·1··1·
~ Alternative121123111

By political group

  • − Deletion The Left 1 Greens/EFA 1 EPP 1 NI 1
  • ~ Alternative The Left 1 S&D 2 Greens/EFA 1 Renew 1 EPP 2 ECR 3 PfE 1 NI 1 Rapporteur 1

Show

  1. 17 Alternative Alex Agius Saliba (rapporteur)Rapporteur · IMCO “Supervisory authorities within”

    (27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preservingseeking to preserve the same or higher level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679.Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person and should be interpreted in line with the case-law of the Court of Justice of the European Union. Supervisory authorities within the European Data Protection Board, should continue supporting controllers and processors in the application of Regulation (EU) 2016/679 while remaining independent. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵. The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act.

    Rapporteur
    Alex Agius Saliba
    Group
    Rapporteur
    Targets
    Digital Omnibus proposal Recital 27
    Document
    IMCO draft opinion
    Printed header
    Recital 27
  2. 110 Deletion Daniel BudaEPP · JURI Deletes the recital

    [...]

    Justification

    Textul nu reflectă în mod adecvat jurisprudența CJUE, merge dincolo de aceasta și nu are în vedere ansamblul practicii judiciare relevante. Modificarea ar conduce la o restrângere a conceptului de date cu caracter personal cu impact direct asupra drepturilor fundamentale. În plus, stabilirea momentului în care datele nu mai sunt personale după pseudonimizare afectează direct domeniul de aplicare al dreptului UE și nu ar trebui reglementată prin acte de punere în aplicare. Abordarea COM pare să excludă anumite date „pseudonimizate” din domeniul de aplicare al Regulamentului (UE) 2016/679, ceea ce contravine înțelegerii actuale potrivit căreia acestea sunt acoperite de regulament și ar putea afecta în mod negativ dreptul fundamental la protecția datelor.

    Tabled by
    Daniel Buda
    Group
    EPP
    Targets
    Digital Omnibus proposal Recital 27
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Recital 27
  3. 157 Alternative David CormandGreens/EFA · IMCO “This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst seeking to preserve…”

    (27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preservingseeking to preserve the same or higher level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, accountand should be takeninterpreted ofin allline the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into accountwith the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessaryand to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵. The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act.

    Tabled by
    David Cormand on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    Digital Omnibus proposal Recital 27
    Document
    IMCO amendments 125–328 to the draft opinion
    Printed header
    Recital 27
  4. 211 Deletion Markéta GregorováGreens/EFA · ITRE–LIBE Deletes the recital

    [...]

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    Digital Omnibus proposal Recital 27
    Document
    ITRE–LIBE amendments 79–250 to the draft report
    Printed header
    Recital 27
  5. 212 Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the recital

    [...]

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    Digital Omnibus proposal Recital 27
    Document
    ITRE–LIBE amendments 79–250 to the draft report
    Printed header
    Recital 27
  6. 213 Deletion João OliveiraThe Left · ITRE–LIBE Deletes the recital

    [...]

    Tabled by
    João Oliveira
    Group
    The Left
    Targets
    Digital Omnibus proposal Recital 27
    Document
    ITRE–LIBE amendments 79–250 to the draft report
    Printed header
    Recital 27
  7. 214 Alternative Marina Kaljurand +8S&D · ITRE–LIBE “This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same…”

    (27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵. The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act.

    Tabled by
    Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
    Group
    S&D
    Targets
    Digital Omnibus proposal Recital 27
    Document
    ITRE–LIBE amendments 79–250 to the draft report
    Printed header
    Recital 27
  8. 215 Alternative Pernando Barrena ArzaThe Left · ITRE–LIBE “This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same…”

    (27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵. The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act.

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    Digital Omnibus proposal Recital 27
    Document
    ITRE–LIBE amendments 79–250 to the draft report
    Printed header
    Recital 27
  9. 216 Alternative Aura Salla +9EPP · ITRE–LIBE “It should also be clarified that information, which is apparently impersonal, may still be considered personal data if the data subject can be…”

    (27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given person or entity where that person or entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵Council. It should also be clarified that information, which is apparently impersonal, may still be considered personal data if the data subject can be identified with additional information obtained from another person or entity through means reasonably likely to be used making it possible to identify the data subject. In such circumstances, the fact that the information enabling the data subject to be identified is in the hands of other people does not prevent that data subject from being identifiable for the controller. The Court of Justice of the European Union has also held that information which are in themselves impersonal may become personal in nature where the controller puts them, or is likely to put them, at the disposal of other persons or entities who have means reasonably likely to enable the data subject to be identified. It is apparent, in particular, that if that information is put at these other persons or entities’ disposal – then this information is personal data for these persons and entities and, indirectly, for the controller. Accordingly, in so far as it cannot be ruled out that those persons or entities have means reasonably allowing them to attribute pseudonymised data to the data subject, such as cross-checking with other data at their disposal, the data subject must be regarded as identifiable as regards both that transfer and any subsequent processing of those data by those persons and entities. In such circumstances, pseudonymised data should be considered to be personal data. The Commission, together with the European Data Protection Board, shouldmay support controllers in the application of this updated definition by stipulating technical criteria in an implementing act.

    Tabled by
    Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Angelika Niebler, Adina Vălean, Henrik Dahl, Andrea Wechsler, Eva Maydell, Pekka Toveri, Christian Ehler
    Group
    EPP
    Targets
    Digital Omnibus proposal Recital 27
    Document
    ITRE–LIBE amendments 79–250 to the draft report
    Printed header
    Recital 27
  10. 217 Alternative Irena Joveva +5Renew · ITRE–LIBE “threshold for the application of data protection rights and must remain completely objective. Personal data which have undergone pseudonymisation…”

    (27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same or higher level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly.The definition of personal data determines the fundamental threshold for the application of data protection rights and must remain completely objective. Personal data which have undergone pseudonymisation, and which could be attributed to a natural person by the use of additional information, must be considered as personal data, as data related to identified or identifiable natural person across all processing participants, independent of an individual controller’s subjective intent, technical capabilities, or internal commercial restrictions. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵. The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act.

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    Digital Omnibus proposal Recital 27
    Document
    ITRE–LIBE amendments 79–250 to the draft report
    Printed header
    Recital 27
Show 6 more amendments
  1. 218 Alternative Francesco Torselli +1ECR · ITRE–LIBE “In assessing means reasonably likely to be used to identify the natural person, account should be taken not only of the means available to the entity…”

    (27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. In assessing means reasonably likely to be used to identify the natural person, account should be taken not only of the means available to the entity processing the information, but also of means reasonably accessible to third parties operating within the same relevant sectoral or territorial environment. For data generated in the course of primary economic activities characterised by a strong territorial dimension, such as agriculture, forestry, fisheries and aquaculture, the combination of geographical, production-related and size-related variables constitutes a specific risk factor for the identification of the natural person and, as a general rule, supports maintaining the classification of such data as personal data. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵. The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act.

    Tabled by
    Francesco Torselli, Paolo Inselvini
    Group
    ECR
    Targets
    Digital Omnibus proposal Recital 27
    Document
    ITRE–LIBE amendments 79–250 to the draft report
    Printed header
    Recital 27
  2. 219 Alternative Dario NardellaS&D · ITRE–LIBE “In assessing means reasonably likely to be used to identify the natural person, account should be taken not only of the means available to the entity…”

    (27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. In assessing means reasonably likely to be used to identify the natural person, account should be taken not only of the means available to the entity processing the information, but also of means reasonably accessible to third parties operating within the same relevant sectoral or territorial environment. For data generated in the course of primary economic activities characterised by a strong territorial dimension, such as agriculture, forestry, fisheries and aquaculture, the combination of geographical, production-related and size-related variables constitutes a specific risk factor for the identification of the natural person and, as a general rule, supports maintaining the classification of such data as personal data. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵. The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act.

    Justification

    Il dato aziendale agricolo è di norma re-identificabile attraverso la specificità semantica delle variabili che lo compongono, non attraverso l’accesso a informazioni aggiuntive esterne. La sepecificità semantica si concretizza nella combinazione di localizzazione, coltura, dimensione e resa è sufficiente a identificare un singolo produttore per qualsiasi soggetto operante nel contesto locale, indipendentemente dai mezzi tecnici a disposizione dell’entità che tratta i dati. L’emendamento àncora la valutazione dei mezzi ragionevolmente utilizzabili al contesto settoriale e territoriale, coerentemente con la giurisprudenza della Corte di giustizia dell’Unione europea in materia di identificabilità indiretta.

    Tabled by
    Dario Nardella
    Group
    S&D
    Targets
    Digital Omnibus proposal Recital 27
    Document
    ITRE–LIBE amendments 79–250 to the draft report
    Printed header
    Recital 27
  3. 220 Alternative François-Xavier BellamyEPP · ITRE–LIBE “(Recital 27 - Regulation (EU) 2016/679)”

    (27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable for a given entity. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵ . The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act. (Recital 27 - Regulation (EU) 2016/679)

    Tabled by
    François-Xavier Bellamy
    Group
    EPP
    Targets
    Digital Omnibus proposal Recital 27
    Document
    ITRE–LIBE amendments 79–250 to the draft report
    Printed header
    Recital 27
  4. 221 Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “assessment of whether a controller possesses the means reasonably likely to be used to identify the natural person directly or indirectly should take…”

    (27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵ . The assessment of whether a controller possesses the means reasonably likely to be used to identify the natural person directly or indirectly should take into account technical and organisational measures, as well as state of the art technology. The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act.

    Tabled by
    Sebastian Tynkkynen, Diego Solier
    Group
    ECR
    Targets
    Digital Omnibus proposal Recital 27
    Document
    ITRE–LIBE amendments 79–250 to the draft report
    Printed header
    Recital 27
  5. 222 Alternative Diana Iovanovici ŞoşoacăNI · ITRE–LIBE “while respecting fundamental human rights and freedoms”

    (27) This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly, while respecting fundamental human rights and freedoms. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable, without fundamental rights and freedoms being affected. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵. The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act, while respecting fundamental human rights and freedoms.

    Tabled by
    Diana Iovanovici Şoşoacă
    Group
    NI
    Targets
    Digital Omnibus proposal Recital 27
    Document
    ITRE–LIBE amendments 79–250 to the draft report
    Printed header
    Recital 27
  6. 223 Alternative Julie Rechagneux +7ECR, PfE · ITRE–LIBE “Regulation (EU) 2016/679 protects natural persons with regard to the processing of personal data. Personal data originate from a natural person and…”

    (27) Regulation (EU) 2016/679 protects natural persons with regard to the processing of personal data. Personal data originate from a natural person and derive their protected character from that origin. Any clarification of the notion of identifiability must therefore preserve the link between the data and the natural person from whom they originate, and may not have the effect of removing from the scope of that Regulation data which relate to a natural person merely because a given entity is not, at a given moment, in a position to identify that person. This Regulation proposes a series of targeted amendments to Regulation (EU) 2016/679 for clarification and simplification, whilst preserving the same level of data protection. Article 4 of Regulation (EU) 2016/679 provides that personal data is any information relating to an identified or identifiable natural person. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. Taking into account the case-law of the Court of Justice of the European Union concerning the definition of personal data, it is necessary to provide further clarity on when a natural person should be considered to be identifiable.The definition of personal data as currently laid down in Regulation (EU) 2016/679 shall not be called into question. Personal data originates from a natural person; whether it remains personal data depends on whether that person is identifiable, the degree of re-identifiability being assessed through the notions of pseudonymous, pseudonymised and anonymised data. The assessment of whether a natural person is identifiable shall be distinguished from the definition of personal data, except for anonymised data, which lose their qualification as personal data. The existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person or entity, personal data for the purposes of the application of Regulation (EU) 2016/679. In particular, it should be clarified that information is not to be considered personal data for a given entity where that entity does not have means reasonably likely to be used to identify the natural person to whom the information relates. A potential subsequent transmission of that information to third parties who have means reasonably allowing them to identify the natural person to whom the information relates, such as cross-checking with other data at their disposal, renders that information personal data only for those third parties who have such means at their disposal. An entity for which the information is not personal data, in principle, does not fall within the scope of application of Regulation (EU) 2016/679.The new specifications introduced by this Regulation apply to the notions of 'pseudonymous' and 'pseudonymisation'. In this respect the Court of Justice of the European Union has held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour. An example of a prohibition against reidentification can be found in the obligations of health data users in Article 61(3) of Regulation (EU) 2025/327 of the European Parliament and of the Council¹⁵ . The Commission, together with the European Data Protection Board, should support controllers in the application of this updated definition by stipulating technical criteria in an implementing act.

    Justification

    The Commission introduces the relativity of the notion of personal data into the definition itself, in Article 4. This exceeds a technical amendment and touches upon the substance of a fundamental right, as the EDPB and the EDPS have both stressed. The amendment leaves the definition intact and houses identifiability in a graded regime — pseudonymous, pseudonymised, anonymised — which delivers the same legal certainty without distorting Article 4.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    Digital Omnibus proposal Recital 27
    Document
    ITRE–LIBE amendments 79–250 to the draft report
    Printed header
    Recital 27