Digital Omnibus proposal· Recital 38

3 amendments would delete the whole recital: members of The Left and S&D.

1. 6 ~Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “The data subject’s rights should not be negatively impacted by the implementation of automated individual decision-making. Human involvement with…”

   (38) Article 22 of Regulation (EU) 2016/679 provides forthat data subjects have the right not to be subject to a decision based solely on automated processing, except where specific conditions are met and in accordance with rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisionswhen assessing whether a decision based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. WhenHowever, when several equally effective automated processing solutions exist, the controller should use the less intrusive one. The data subject’s rights should not be negatively impacted by the implementation of automated individual decision-making. Human involvement with regard to automated decision-making should be meaningful, and a mere symbolic gesture by a human of viewing the decision made without having a real and factual influence on the decision-making should not be categorised as human involvement.

   Rapporteurs

   Aura Salla and Marina Kaljurand

   Group

   Rapporteurs

   Targets

   Digital Omnibus proposal Recital 38

   Document

   ITRE–LIBE draft report

   Source

   Official text, page 11

   Printed header

   Recital 38

   Links

   Link to this amendment
   Cite this amendment

2. 128 −Deletion Arash SaeidiThe Left · JURI Deletes the recital

   (38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.

   Tabled by

   Arash Saeidi

   Group

   The Left

   Targets

   Digital Omnibus proposal Recital 38

   Document

   JURI amendments 69–296 to the draft opinion

   Source

   Official text, pages 58–59

   Printed header

   Recital 38

   Links

   Link to this amendment
   Cite this amendment

3. 129 ~Alternative Emil RadevEPP · JURI “The requirement to provide ‘meaningful information about the logic involved’ does not oblige controllers to disclose internal algorithms, proprietary…”

   (38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The requirement to provide “meaningful information about the logic involved” does not oblige controllers to disclose internal algorithms, proprietary logic, or commercially sensitive business knowledge comparable to trade secret.

   Tabled by

   Emil Radev

   Group

   EPP

   Targets

   Digital Omnibus proposal Recital 38

   Document

   JURI amendments 69–296 to the draft opinion

   Source

   Official text, pages 59–60

   Printed header

   Recital 38

   Links

   Link to this amendment
   Cite this amendment

4. 173 ~Alternative Sophia KircherEPP · IMCO “The requirement to provide ‘meaningful information about the logic involved’ does not oblige controllers to disclose internal algorithms, proprietary…”

   (38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The requirement to provide “meaningful information about the logic involved” does not oblige controllers to disclose internal algorithms, proprietary logic, or commercially sensitive business knowledge.

   Tabled by

   Sophia Kircher

   Group

   EPP

   Targets

   Digital Omnibus proposal Recital 38

   Document

   IMCO amendments 125–328 to the draft opinion

   Source

   Official text, pages 48–49

   Printed header

   Recital 38

   Links

   Link to this amendment
   Cite this amendment

5. 360 −Deletion Pernando Barrena ArzaThe Left · ITRE–LIBE Deletes the recital

   (38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.

   Tabled by

   Pernando Barrena Arza

   Group

   The Left

   Targets

   Digital Omnibus proposal Recital 38

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 122–123

   Printed header

   Recital 38

   Links

   Link to this amendment
   Cite this amendment

6. 361 −Deletion Birgit SippelS&D · ITRE–LIBE Deletes the recital

   (38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.

   Tabled by

   Birgit Sippel

   Group

   S&D

   Targets

   Digital Omnibus proposal Recital 38

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 123–124

   Printed header

   Recital 38

   Links

   Link to this amendment
   Cite this amendment

7. 362 ~Alternative Pernando Barrena ArzaThe Left · ITRE–LIBE “merely because it is useful, efficient, economically advantageous, scalable, faster, more consistent, part of the controller’s business model, or…”

   (38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing.Article 22 of Regulation (EU) 2016/679 provides an important safeguard against automated individual decision-making, including profiling, which produces legal effects concerning a data subject or similarly significantly affects them. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679.In order to preserve the effectiveness of that safeguard, the necessity ground in Article 22(2), point (a), should be interpreted strictly. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.A decision should not be considered necessary for entering into, or performance of, a contract merely because it is useful, efficient, economically advantageous, scalable, faster, more consistent, part of the controller’s business model, or capable of reducing costs. Commercial convenience, service optimisation, fraud prevention at scale, profiling, risk scoring, behavioural prediction or personalised pricing should not, in themselves, constitute necessity. Where automated processing determines or materially determines the outcome of a decision, Article 22 should apply even where a human formally validates, confirms, implements or communicates the outcome. Human involvement should not be used to circumvent Article 22 where it does not include a genuine assessment of the individual case and the authority to change the outcome. Human intervention should be meaningful and carried out by a person with adequate competence, time, information, resources and authority to assess the individual case and modify, reverse or otherwise change the decision. Data subjects should receive meaningful information about the main reasons for the decision, including the main categories of personal data relied upon, the use of profiling or inferred data, the key parameters, factors or criteria that materially influenced the decision, and, where relevant, their relative importance. Such information should be sufficiently specific to allow the data subject to understand why the decision was taken in their individual case and to exercise their rights effectively. Trade secrets, intellectual property or security considerations should not be used to refuse information that is necessary to understand the main reasons for the decision, without prejudice to proportionate measures to protect confidential information. Where a controller relies on contractual necessity under Article 22(2), point (a), the controller should assess whether the same specific contractual purpose can reasonably be achieved through less intrusive means, including human-led, human-reviewed or non-automated alternatives. Where Article 35 applies, that assessment should form part of the data protection impact assessment. The existence of a data protection impact assessment should not, in itself, demonstrate that a decision is necessary within the meaning of Article 22(2), point (a).’

   Tabled by

   Pernando Barrena Arza

   Group

   The Left

   Targets

   Digital Omnibus proposal Recital 38

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 124–125

   Printed header

   Recital 38

   Links

   Link to this amendment
   Cite this amendment

8. 363 ~Alternative Alex Agius SalibaS&D · ITRE–LIBE “The position of a data subject should not be worsened due to the implementation of automated individual decision-making. Therefore, in case of…”

   (38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowedprohibited unless when specific conditions are met, as set out in Regulation (EU) 2016/679. The change from a right of the data subject to a general prohibition with exemptions is needed to bring legal clarity. It shoulddoes alsonot alter the material positions of the parties. In particular, the prohibition laid down in this provision does not need to be clarifiedinvoked thatby whena data subject affected by a decision. When assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could theoretically also be taken by a human does not prevent the controller from taking the decision solely by solely automated processing. WhenHowever, when several equally effective automatedmeans for processing solutionsare existavailable to the controller, the controller shouldmust use the lessleast intrusive onemeans, automated or not. The position of a data subject should not be worsened due to the implementation of automated individual decision-making. Therefore, in case of automated decision-making with human involvement, such involvement must be meaningful in order to result in the inapplicability of Article 22 of Regulation (EU) 2016/679. Human involvement without real and factual influence on the decision-making would be insufficient. The same is true for the human involvement a data subject can request in accordance with Article 22(3) Regulation (EU) 2016/679. Similarly, in order to ensure a consistent and high level of protection of natural persons, legal and similarly significantly affects must be interpreted broadly, and include the decision if a certain payment method is offered to a data subject or which price is offered to customers.

   Tabled by

   Alex Agius Saliba

   Group

   S&D

   Targets

   Digital Omnibus proposal Recital 38

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 126–127

   Printed header

   Recital 38

   Links

   Link to this amendment
   Cite this amendment

9. 364 ~Alternative Irena Joveva +5Renew · ITRE–LIBE “Automated procedures can significantly benefit the digital economy by streamlining routine operations such as Know-Your-Customer (KYC) verifications…”

   (38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing.Automated procedures can significantly benefit the digital economy by streamlining routine operations such as Know-Your-Customer (KYC) verifications or fraud preventions. However, when deployed for a higher risk evaluations producing legal or similarly significant effects, such as automated hiring, the termination of contracts or online accounts, profiling or creditworthiness decision, they entail heightened risks to individual rights. Article 22 of Regulation (EU) 2016/679 provides that the data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.In order to provide greater legal certainty, it should therefore be clarified that decisions based solely on automated processing are generally prohibited, and that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, automated processing is permitted only if no other equally effective and less privacy-intrusive means are available to fulfil the core objective of the contractual service explicitly requested by the data subject. Moreover, to prevent a gap in legal protection, the concept of a decision should extend to automated processing or profiling operations that generate an assessment or value upon which a subsequent controller strongly relies as a determining factor in its decision-making. When several equally effective automated processing solutions exist, the controller should use the least intrusive one, guaranteeing in all cases the data subject’s right to obtain human intervention, express their point of view, and contest the automated outcome, while utilizing appropriate procedures to minimize error risks.

   Tabled by

   Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller

   Group

   Renew

   Targets

   Digital Omnibus proposal Recital 38

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 127–128

   Printed header

   Recital 38

   Links

   Link to this amendment
   Cite this amendment

10. 365 ~Alternative Dario NardellaS&D · ITRE–LIBE “For the purposes of illustration, decisions which produce legal effects concerning the data subject, or similarly significantly affecting the data…”

    (38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one. For the purposes of illustration, decisions which produce legal effects concerning the data subject, or similarly significantly affecting the data subject, within the meaning of Article 22, include creditworthiness assessment systems applied to undertakings in the agricultural sector, algorithmic systems for determining premiums for agricultural insurance policies, including parametric insurance policies, automated systems for processing applications for payments under the common agricultural policy, and automated pricing decisions applied by platforms acting as intermediaries in, or selling, agricultural production inputs. In proceedings involving decisions of that nature, the data subject’s right to obtain human intervention pursuant to Article 22(3) shall include the right to obtain a comprehensible explanation of the factors determining the outcome and the right to have the decision reviewed by a person possessing technical expertise relevant to the agricultural sector.

    Justification

    La casistica applicativa dell’articolo 22 del regolamento (UE) 2016/679 e la prassi dello European Data Protection Board si sono concentrate prevalentemente su altri settori (bancario in senso stretto, sanitario, sicurezza pubblica), con conseguente rischio di marginalizzazione interpretativa del settore agricolo. L’emendamento introduce un ancoraggio settoriale nel considerando, senza modificare il dispositivo dell’articolo, ed è coerente con l’emendamento 53 del Draft Report ITRE-LIBE, che qualifica come «significativo» l’intervento umano richiesto ai sensi del paragrafo 3.

    Tabled by

    Dario Nardella

    Group

    S&D

    Targets

    Digital Omnibus proposal Recital 38

    Document

    ITRE–LIBE amendments 251–400 to the draft report

    Source

    Official text, pages 128–130

    Printed header

    Recital 38

    Links

    Link to this amendment
    Cite this amendment