Article 10a

1 would add wording.

1. 1073 +Addition Axel VossEPP · ITRE–LIBE ‘Article 10a Privileged processing of personal data 1. The following processing serves objectives of general interest recognised by the Union and may…

   3c.After Article 10, a new Article is added:

   "Article 10a

   Privileged processing of personal data

   1.The following processing serves objectives of general interest recognised by the Union and may be privileged in accordance with this Article (‘privileged processing’):

   (a)processing necessary for internal administrative purposes within a group of undertakings, including the processing of personal data of clients and employees;

   (b)processing by a micro, small or medium-sized enterprise within the meaning of the Annex to Recommendation 2003/361/EC, necessary for its ordinary commercial activities;

   (c)processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), whether or not it constitutes further processing within the meaning of point (b) of Article 5(1).

   2.Processing referred to in paragraph 1 shall be privileged where the controller or processor:

   (a)has committed, by entry in the register referred to in [the Data Act/ Data Governance Act], to making data available for objectives of general interest; and

   (b)carries out the processing in demonstrable conformity with an approved code of conduct pursuant to Article 40, an approved certification mechanism pursuant to Article 42, binding corporate rules approved pursuant to Article 47, or a standard included in the list established by the Board pursuant to Article 70 point (o).

   3.Privileged processing pursues legitimate interests within the meaning of point (f) of Article 6(1). Where it concerns special categories of personal data and is necessary for the objectives referred to in paragraph 1, this Article constitutes a substantial public interest of Article 9(2)(g), (j).

   Privileged processing shall be presumed to comply with the requirements of this Regulation to which the safeguards give effect, including point (f) of Article 6(1), points (g) (j) of Article 9(2) and, where the controller or processor has assessed and documented that the law and practice of the third country do not impair the effectiveness of the safeguards, Article 46(1). The presumption shall be rebutted by specific and substantiated indications of non-compliance; in that event, the controller or processor shall demonstrate compliance in accordance with Article 5(2).

   4.The obligations under Articles 13 and 14 may be fulfilled by providing the standardised information laid down in the instrument referred to in point (b) of paragraph 2.

   5.Data made available under the commitment shall not be provided to undertakings referred to in point (b) of paragraph 6. The commitment may be withdrawn with effect for the future; upon withdrawal, the processing ceases to be privileged. The Commission shall adopt delegated acts in accordance with Article 92 specifying the categories of data to be made available, the conditions and modalities of making them available, and the safeguards for the protection of personal data and trade secrets.

   6.This Article shall not apply to:

   (a)processing likely to result in a high risk within the meaning of Article 35, unless a data protection impact assessment has been carried out and its results have been implemented;

   (b)processing by an undertaking designated pursuant to Article 3 of Regulation (EU) 2022/1925 or Article 33(4) of Regulation (EU) 2022/2065, or by an undertaking belonging to the same group of undertakings.

   Justification

   This amendment creates an incentive model for data use serving general-interest objectives, such as intra-group administration, SME operations, research, archiving and statistics. Privileged status is limited to actors that make a data-sharing commitment and follow recognised safeguards, including codes, certification, BCRs or listed standards. The rebuttable presumption rewards accountable governance without lowering protection, excludes gatekeepers and VLOPs/VLOSEs, and covers high-risk processing only after a DPIA.

   Tabled by

   Axel Voss

   Group

   EPP

   Targets

   GDPR Article 10a (new)

   Document

   ITRE–LIBE amendments 1053–1260 to the draft report

   Source

   Official text, pages 20–23

   Printed header

   Article 3 – paragraph 1 – point 3 c (new) / Regulation (EU) 2016/679 / Article 10a (new)

   Links

   Link to this amendment
   Cite this amendment
   Preview in the full article