Recital 40a (new)
Only Parliament amendments propose this recital. Parliament committees have tabled 2 amendments to this recital.
Latest text22 October 2026ST 14756/26
Contains no amendment to this recital.
Numbering
Only Parliament amendments propose this recital. The Commission proposal and the Council texts number other recitals 40–40b: Recitals 40–40b.
Parliament amendments
2 amendments to this recital
2 would add wording.
| Type | EPP | ECR | PfE |
|---|---|---|---|
| + Addition | 1 | 1 | 1 |
By political group
- + Addition EPP 1 ECR 1 PfE 1
393 +Addition Julie Rechagneux +8ECR, PfE · ITRE–LIBE “Where, in respect of the same processing operation, a controller is required to carry out a data protection impact assessment under Article 35 of…” numbered 40a
(40a)Where, in respect of the same processing operation, a controller is required to carry out a data protection impact assessment under Article 35 of Regulation (EU) 2016/679 and is also subject to an obligation to carry out a fundamental rights impact assessment under Article 27 of Regulation (EU) 2024/1689, or to a reporting obligation in respect of automated monitoring or decision-making systems under other Union law, those obligations may be satisfied by means of a single integrated assessment. Such an assessment satisfies each of those obligations only where it covers all the elements required by each applicable provision; the substantive requirements, thresholds and triggering conditions laid down in those provisions remain unaffected. The integrated assessment should be made available to each competent authority within the framework of its respective competences and should not be required to be submitted to a single authority. The single Union list of processing operations subject to a data protection impact assessment should reflect processing operations presenting genuinely high risks to the rights and freedoms of natural persons, and should not consist of the accumulation of the requirements laid down in national lists.
Justification
Vertically integrated operators face a triple documentation burden for one and the same activity. The amendment mutualises the documentary instrument.
- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay
- Group
- ECR, PfE
- Targets
- Digital Omnibus proposal Recital 40a (new)
- Document
- ITRE–LIBE amendments 251–400 to the draft report
- Printed header
- Recital 40 a (new)
394 +Addition Aura Salla +7EPP · ITRE–LIBE “Regulation (EU) 2016/679 follows a technology-neutral, risk-based and purpose-driven approach to the processing of personal data. The lawfulness of…” numbered 40a
(40a)Regulation (EU) 2016/679 follows a technology-neutral, risk-based and purpose-driven approach to the processing of personal data. The lawfulness of processing should be determined by reference to a specific and legitimate purpose and an assessment of the risks posed to the rights and freedoms of natural persons, taking into account the nature, scope, context and purposes of the processing. Where personal data are processed through the terminal equipment of natural persons, and the available indicators demonstrate that the likelihood and severity of risks to those rights and freedoms are limited, reliance on legal bases other than consent may be justified, where appropriate.
- Tabled by
- Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Paulo Cunha, Andrea Wechsler, Oliver Schenk, Pekka Toveri, Christian Ehler
- Group
- EPP
- Targets
- Digital Omnibus proposal Recital 40a (new)
- Document
- ITRE–LIBE amendments 251–400 to the draft report
- Source
- Official text, page 163
- Printed header
- Recital 40 a (new)