Recital 27b (new)

2 would add wording.

1. 228 +Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “The recognised privacy-enhancing techniques on which the protection of pseudonymous data relies should reflect the state of the art and be promoted…” numbered 27b

   (27b)The recognised privacy-enhancing techniques on which the protection of pseudonymous data relies should reflect the state of the art and be promoted across the Union. They include, in particular, pseudonymisation and key separation, strong encryption of data at rest and in transit, aggregation and generalisation, the addition of statistical noise and differential privacy, synthetic data generation, secure multi-party computation, the use of secure processing environments, and contractual and organisational prohibitions on re-identification. The Commission, in close cooperation with the European Data Protection Board, should support controllers and processors in applying such techniques and in assessing the residual risk of re-identification, taking into account the means reasonably likely to be used, and should stipulate the relevant technical criteria by means of an implementing act.

   Justification

   Gives operational content to the notion of privacy-enhancing technique, on which the regime for pseudonymised data rests. The reference to an implementing act avoids freezing into the Regulation a state of the art that is bound to evolve.

   Tabled by

   Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay

   Group

   ECR, PfE

   Targets

   Digital Omnibus proposal Recital 27b (new)

   Document

   ITRE–LIBE amendments 79–250 to the draft report

   Source

   Official text, pages 152–153

   Printed header

   Recital 27 b (new)

   Links

   Link to this amendment
   Cite this amendment

2. 229 +Addition Axel VossEPP · ITRE–LIBE “At the same time the rules in Regulation (EU) 2016/679 have proven to be too lenient for very large controllers, such as data brokers or large…” numbered 27b

   (27b)At the same time the rules in Regulation (EU) 2016/679 have proven to be too lenient for very large controllers, such as data brokers or large platforms. Hence a category of large controllers is introduced to ensure more stringent rules of controllers with large processing operations. Large controllers shall for example be regularly inspected, face increased transparency and reporting obligations. Large controllers are defined by absolute or relative number of data subjects in any given Member State, to include dominant controllers in all Member States. A national list of such large controllers shall allow supervisory authorities and the public to have transparency about relevant controllers.

   Justification

   RISK-BASED APPROACH #2: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.

   Tabled by

   Axel Voss

   Group

   EPP

   Targets

   Digital Omnibus proposal Recital 27b (new)

   Document

   ITRE–LIBE amendments 79–250 to the draft report

   Source

   Official text, pages 153–154

   Printed header

   Recital 27 b (new)

   Links

   Link to this amendment
   Cite this amendment