Research

Digital Omnibus tracker

Digital Omnibus proposal

Recital 27c

Compare the available Commission, Council and Parliament texts and amendments affecting this recital.

Recital total: 1 part · 4 Council drafts · 2 Parliament amendments

Removed wording is struck through; added or replacement wording is highlighted.

Institutional text

European Commission proposal

The wording proposed by the Commission at the start of this legislative file.

No standalone Commission wording is mapped to these tracked parts. A newly proposed provision may have no earlier text of its own.

Institutional text

Council Presidency texts

Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.

Recital 27b

May Presidency compromise

Pseudonymisation is one of the possible security measures within the meaning of Article 32 of Regulation (EU) 2016/679 and does not necessarily have to be applied in all cases. Whether pseudonymisation is appropriate, should be assessed on a case-bycase basis and depends on the context, the nature of the personal data and the existence of other appropriate technical and organisational measures. The effective application of pseudonymisation may also be clarified for controllers and processors through the approval of specific codes of conduct in accordance with Article 40 of Regulation (EU) 2016/679, taking account of the specific characteristics of the processing carried out in certain sectors and the specific needs of micro, small and medium enterprises.

Competing proposals

European Parliament amendments

These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.

More filters

Additional proposed wording Amendment 230 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
(27c)

The principles of data minimisation and data protection by design and by default are essential when processing involves significant risks to the fundamental rights of individuals. Taking into account the state of the art, all parties to data sharing falling within the scope of this Regulation should implement appropriate technical and organisational measures to protect those rights. Such measures include not only pseudonymisation and encryption, but also increasingly available technologies that permit algorithms to be brought to the data and valuable insights to be derived without the transmission between parties or the unnecessary copying of the raw or structured data themselves, while minimising the exposure of personal data and of strategically significant data to unnecessary transfer, copying or third-country access. Where personal data would otherwise be transmitted or re-used, preference should be given, where technically available and proportionate, to methods that bring computation to the data within a secure processing environment, including federated analysis or equivalent privacy-preserving methods, over the transmission or copying of the data themselves.

Additional proposed wording Amendment 231 · Axel Voss ITRE · LIBE
(27c)

Given the limited resource of supervisory authorities, large controllers shall be certified for compliance with Regulation (EU) 2016/679 each year. To ensure a high level of protection and to ensure that certification bodies that knowingly and repeatedly certified conduct that was clearly or foreseeably unlawful, new options for the revocation of accreditation are introduced.

Justification

RISK-BASED APPROACH #3: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.