Recital 38a (new)

4 would add wording.

1. 374 +Addition Axel VossEPP · ITRE–LIBE “To ensure compliance with the requirements of this Regulation in respect of the processing to be carried out by the processor on behalf of the…” numbered 38a

   (38a)To ensure compliance with the requirements of this Regulation in respect of the processing to be carried out by the processor on behalf of the controller, when entrusting a processor with processing activities, the controller should use only processors providing sufficient guarantees, in particular in terms of expert knowledge, reliability and resources, to implement technical and organisational measures which will meet the requirements of this Regulation, including for the security of processing. The adherence of the processor to an approved code of conduct or an approved certification mechanism may be used as an element to demonstrate compliance with the obligations of the controller. If processing by a processor is governed by an agreement with the controller which specifies the subject matter and duration of the processing, the nature and purpose of the processing, the types of data to be processed and the categories of data subjects the tasks and duties of the processor shall be directly qualified by this Regulation in order to avoid legal uncertainty and provide clear standards for all parties, which process personal data within the scope of European law. Furthermore, if the processor provides a binding assurance as to the level of protection to which it is able to ensure the security of the processing and its obligation to assist the controller by means of appropriate technical and organisational measures and confirms the suitability of these safeguards for the processing operations it intends to carry out, due to the nature of these services as mere digital infrastructure Services their agreements may renounce on some specific notification requirements of controllers. However, processors who fail to fulfil those assurances are directly liable for this non compliance. After the completion of the processing on behalf of the controller, the processor should, at the choice of the controller, return or delete the personal data, unless there is a requirement to store the personal data under Union or Member State law to which the processor is subject.

   Justification

   Article 28 should better reflect modern cloud, hosting, security and infrastructure services, which are standardised, layered and technically complex. For such infrastructure processing, controllers need enforceable assurances on security, assistance and downstream liability, not bespoke descriptions of every technical sub-operation. The amendment cuts formalistic contract burdens while preserving core duties: confidentiality, security, assistance, deletion or return, audits, controller suitability checks and processor liability for sub-processors.

   Tabled by

   Axel Voss

   Group

   EPP

   Targets

   Digital Omnibus proposal Recital 38a (new)

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 138–140

   Printed header

   Recital 38 a (new)

   Links

   Link to this amendment
   Cite this amendment

2. 375 +Addition Aura Salla +5EPP · ITRE–LIBE “While Article 28 of Regulation 2016/679 establishes a robust framework for contractual accountability, its practical application has created a…” numbered 38a

   (38a)While Article 28 of Regulation 2016/679 establishes a robust framework for contractual accountability, its practical application has created a structural asymmetry when controllers often rely on systemic digital actors designated as gatekeepers under Regulation (EU) 2022/1925. This creates a redundant administrative burden for small and medium-sized enterprises (SMEs), small mid-cap enterprises (SMCs) and public authorities. To eliminate this red tape and enhance digital sovereignty, a direct compliance mechanism should apply solely to gatekeepers by way of derogation from Article 28. Where a processor is a designated gatekeeper, its core data protection duties should come directly from this Regulation. Processors not designated as gatekeepers do not possess equivalent market power and remain entirely subject to the standard contractual framework, preserving contractual freedom and a competitive digital ecosystem.

   Tabled by

   Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Andrea Wechsler, Pekka Toveri, Christian Ehler

   Group

   EPP

   Targets

   Digital Omnibus proposal Recital 38a (new)

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, page 140

   Printed header

   Recital 38 a (new)

   Links

   Link to this amendment
   Cite this amendment

3. 376 +Addition Pernando Barrena ArzaThe Left · ITRE–LIBE “Controllers employing large-scale automated individual decision-making systems, such as automatic rejections or terminations of contracts or…” numbered 38a

   (38a)Controllers employing large-scale automated individual decision-making systems, such as automatic rejections or terminations of contracts or accounts, credit scoring or hiring decisions benefit from more efficient procedures, but should also ensure compliance of these systems. Therefore, all automated individual decision-making systems affecting a relevant number of individuals should be subject to a data protection impact assessment and should be demonstratable based scientifically recognised mathematical and statistical methods.

   Tabled by

   Pernando Barrena Arza

   Group

   The Left

   Targets

   Digital Omnibus proposal Recital 38a (new)

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, pages 140–141

   Printed header

   Recital 38 a (new)

   Links

   Link to this amendment
   Cite this amendment

4. 377 +Addition Markéta GregorováGreens/EFA · ITRE–LIBE “For the purposes of this Regulation and Regulation (EU) 2016/679, free and open-source software, including whether it has been developed or supplied…” numbered 38a

   (38a)For the purposes of this Regulation and Regulation (EU) 2016/679, free and open-source software, including whether it has been developed or supplied outside the course of a commercial activity, should have the same meaning as defined and further specified in Regulation (EU) 2024/2847.

   Tabled by

   Markéta Gregorová on behalf of the Verts/ALE Group

   Group

   Greens/EFA

   Targets

   Digital Omnibus proposal Recital 38a (new)

   Document

   ITRE–LIBE amendments 251–400 to the draft report

   Source

   Official text, page 141

   Printed header

   Recital 38 a (new)

   Links

   Link to this amendment
   Cite this amendment