EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

GDPR· Article 12

Analysis in our dossiers
Where the file stands·Access, transparency and automated decisions

Text

Article 12 GDPR as printed in the Council text of 22 October 2026

Transparent information, communication and modalities for the exercise of the rights of the data subject

Source Council, 22 October 2026. Article 12: ST 14756/26, page 134 · exact text page

Scope This text prints Article 12(5) only.

5.

Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or, for a request under Article 15, where an abusive intention on the part of the data subject submitting those requests can be demonstrated, the controller may either:

(a)

charge a reasonable fee proportionate to the administrative costs of providing the information or communication or taking the action requested; or

(b)

refuse to act on the request and inform the data subject of the reasons thereof.

The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that, in the light of all the relevant circumstances of the case, that the request is excessive or that there is an abusive intention on the part of the data subject.

Article 12 in the whole GDPR

How each paragraph has changed

Show the statuses
What each text would do to the law in force
Paragraph Commission19 Nov 2025Council21 May 2026Council10 Jun 2026Council18 Jun 2026Council3 Sep 2026Council2 Oct 2026Council22 Oct 2026 Parliamentamendments
Compared withlaw in forcethe proposal21 May text10 Jun text18 Jun text3 Sep text2 Oct text
5Paragraph 5 Amends Changed Amends , changed since the proposal Changed Amends , changed since 21 May Changed Amends , changed since 10 Jun Changed Amends , changed since 18 Jun Changed Amends , changed since 3 Sep Changed Amends Unchanged 37
Provisions only Parliament would add or change6 units Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text 7

Each text against the law in force: ~Amends amends the law in force— neither the law in force nor the text has it changed from the text before

Each text against the text before it: ~Changed wording changed=Unchanged same as the text before— in neither text

What each text does

  1. 19 Nov 2025 Commission proposalCOM(2025) 837 Amends Amends paragraph 5. Article 12 in this text
  2. 21 May 2026 Council textST 9547/26 Changed Changes paragraph 5.ST 9547/26 reproduces only some of the proposal’s changes, so this comparison applies only those it shows or visibly drops. It says nothing about the others. Article 12 in this text
  3. 8 Jun 2026 IMCO draft opinion · Alex Agius Saliba (rapporteur)IMCO-PA-789877 5 amendments to this article. Amendments in this document
  4. 10 Jun 2026 Council textST 10426/26 Changed Changes paragraph 5. Article 12 in this text
  5. 18 Jun 2026 Council textST 10677/26 Changed Changes paragraph 5. Article 12 in this text
  6. 22 Jun 2026 ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)CJ72-PR-786818 4 amendments to this article. Amendments in this document
  7. 29 Jun 2026 JURI amendments 69–296 to the draft opinionJURI-AM-790236 3 amendments to this article. Amendments in this document
  8. 16 Jul 2026 IMCO amendments 329–532 to the draft opinionIMCO-AM-791061 4 amendments to this article. Amendments in this document
  9. 27 Jul 2026 ITRE–LIBE amendments 1053–1260 to the draft reportCJ72-AM-791073 28 amendments to this article. Amendments in this document
  10. 3 Sep 2026 Council textST 12535/26 Changed Changes paragraph 5. Article 12 in this text
  11. 2 Oct 2026 Council textST 13886/26 Changed Changes paragraph 5.Page 126 prints “(9a)” without an instruction or target, so no change can be assigned to that marker. Article 12 in this text
  12. 22 Oct 2026 Council textST 14756/26 Unchanged Same as the text before. Article 12 in this text

Paragraph 5

Changed by the Commission · changed by the Council on 21 May · changed on 10 June · changed on 18 June · changed on 3 September · changed on 2 October

Parliament amendments 37

19 would delete the wording, 14 propose alternative wording and 4 would add wording to paragraph 5. Deletion amendments come from The Left, S&D, Greens/EFA, Renew, EPP, ECR, PfE and non-attached members, and from the IMCO rapporteur’s draft opinion.

By political group; co-sponsored amendments count for each group
TypeThe LeftS&DGreens/EFARenewEPPECRPfENIRapporteur
− Deletion311152413
~ Alternative5···142·3
+ Addition····122·1

By political group

  • − Deletion The Left 3 S&D 1 Greens/EFA 1 Renew 1 EPP 5 ECR 2 PfE 4 NI 1 Rapporteur 3
  • ~ Alternative The Left 5 EPP 1 ECR 4 PfE 2 Rapporteur 3
  • + Addition EPP 1 ECR 2 PfE 2 Rapporteur 1

Show

  1. 48 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of…”

    (5) Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, forthe requestscontroller undershall Article 15 becausegive the data subject abusesa thechoice rights conferred by this regulation for purposes other than the protection of their data, the controller may eitherbetween: (a) chargepaying a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request.their request being refused.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – subparagraph 1 – introductory part
  2. 49 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.”

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or thatexcessive therecharacter areof reasonablethe grounds to believe that it is excessiverequest.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – subparagraph 2
  3. 103 Alternative Alex Agius Saliba (rapporteur)Rapporteur · IMCO “Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of…”

    5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either:

    Justification

    With this amendment the rapporteur is trying to ensure that the exercise of this consumer right is not becoming more difficult.

    Rapporteur
    Alex Agius Saliba
    Group
    Rapporteur
    Targets
    GDPR Article 12(5)
    Document
    IMCO draft opinion
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – subparagraph 1 – introductory part
  4. 104 Deletion Alex Agius Saliba (rapporteur)Rapporteur · IMCO Deletes the Commission’s wording

    (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

    Justification

    With this amendment the rapporteur is trying to ensure that the exercise of this consumer right is not becoming more costly.

    Rapporteur
    Alex Agius Saliba
    Group
    Rapporteur
    Targets
    GDPR Article 12(5)
    Document
    IMCO draft opinion
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – subparagraph 1 – point a
  5. 105 Deletion Alex Agius Saliba (rapporteur)Rapporteur · IMCO Deletes the Commission’s wording

    (b) refuse to act on the request.

    Justification

    With this amendment the rapporteur is trying to ensure that the exercise of this consumer right is not becoming more difficult.

    Rapporteur
    Alex Agius Saliba
    Group
    Rapporteur
    Targets
    GDPR Article 12(5)
    Document
    IMCO draft opinion
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – subparagraph 1 – point b
  6. 106 Deletion Alex Agius Saliba (rapporteur)Rapporteur · IMCO Deletes the Commission’s wording

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.

    Rapporteur
    Alex Agius Saliba
    Group
    Rapporteur
    Targets
    GDPR Article 12(5)
    Document
    IMCO draft opinion
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – subparagraph 2
  7. 107 Addition Alex Agius Saliba (rapporteur)Rapporteur · IMCO “The controller shall not engage in any behaviour that undermines the effective exercise of data subjects’ rights provided for in Articles 12 to 22…”

    The controller shall not engage in any behaviour that undermines the effective exercise of data subjects’ rights provided for in Articles 12 to 22, making the exercise of those rights unduly difficult.

    The controller shall not abusively resort to the exceptions under Article 12(5) in a manifestly unfounded or excessive manner, in particular because of the frequency in which it limits the rights of the same or other data subjects, thereby exceeding the limits of what is appropriate and necessary.

    Justification

    Inspired by article 13 of the DMA on anti-circumvention to ensure protection against abuse by for example dark patterns, for companies for resorting to the exceptions under Article 12(5).

    Rapporteur
    Alex Agius Saliba
    Group
    Rapporteur
    Targets
    GDPR Article 12(5)
    Document
    IMCO draft opinion
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  8. 243 Deletion Arash SaeidiThe Left · JURI Deletes the Commission’s wording

    5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.

    Tabled by
    Arash Saeidi
    Group
    The Left
    Targets
    GDPR Article 12(5)
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 3 – paragraph 5
  9. 244 Alternative Mario MantovaniECR · JURI “Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of…”

    Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also,because forthere requestsare underreasonable Articlegrounds 15to becausebelieve that the datarequest subjecthas abusesbeen the rights conferred by this regulationsubmitted for purposes other than the protection of theirthat subject’s personal data, the controller may either:

    Tabled by
    Mario Mantovani
    Group
    ECR
    Targets
    GDPR Article 12(5)
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  10. 245 Alternative Mario MantovaniECR · JURI “Data controllers, notably SMEs, may also refuse a request if the data processing poses a limited risk to the rights and freedoms of the data subject…”

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.’Data controllers, notably SMEs, may also refuse a request if the data processing poses a limited risk to the rights and freedoms of the data subject and if the request is not commensurate with the risks that such data processing entails. If the controller refuses to comply with a request on the grounds referred to in this Article, the data subject must demonstrate that the request is legitimate, where applicable.’

    Justification

    SMEs are increasingly having to deal with vexatious or disproportionate requests, which entail considerable administrative costs while availing nothing for data protection. Beyond reimbursing those costs and rejecting manifestly unfounded requests, further safeguards are needed to refuse requests that are disproportionate and pose a minimal risk and to ensure that the burden of proof does not solely reside with the controller. Requiring the data subject to demonstrate that their request is legitimate would protect SMEs from vexatious requests while upholding the guarantees provided by the Regulation.

    Tabled by
    Mario Mantovani
    Group
    ECR
    Targets
    GDPR Article 12(5)
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – point b
Show 27 more amendments
  1. 373 Alternative Virginie JoronPfE · IMCO “refuse to act on the request.”

    Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulationRegulation for purposes otherunrelated thanto the protection of their data, the controller may either:refuse to act on the request.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 12(5)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  2. 374 Deletion Virginie JoronPfE · IMCO Deletes the Commission’s wording

    (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 12(5)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  3. 375 Deletion Virginie JoronPfE · IMCO Deletes the Commission’s wording

    (b) refuse to act on the request.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 12(5)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  4. 376 Deletion Arba KokalariEPP · IMCO Deletes the Commission’s wording

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.

    Tabled by
    Arba Kokalari
    Group
    EPP
    Targets
    GDPR Article 12(5)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  5. 1074 Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the Commission’s wording

    4. In Article 12, paragraph 5 is replaced by the following: ‘5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.’

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  6. 1075 Deletion Markéta GregorováGreens/EFA · ITRE–LIBE Deletes the Commission’s wording

    4. In Article 12, paragraph 5 is replaced by the following: ‘5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.’

    Justification

    The CJEU was able to decide the ‘Brillen Rottler’ case C-526/24 on the basis of the current wording, no need to introduce new ‘abuse’ or other conditions.

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  7. 1076 Deletion Irena Joveva +5Renew · ITRE–LIBE Deletes the Commission’s wording

    4. In Article 12, paragraph 5 is replaced by the following: ‘5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.’

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  8. 1077 Deletion Birgit SippelS&D · ITRE–LIBE Deletes the Commission’s wording

    5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.

    Tabled by
    Birgit Sippel
    Group
    S&D
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  9. 1078 Alternative João OliveiraThe Left · ITRE–LIBE “Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of…”

    Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are deemed manifestly unfounded or excessive, in particular because of their repetitive character or also, forthe requestscontroller undershall Articlepropose 15 becauseto the data subject abuses the rightsfollowing conferred by this regulation for purposes other than the protection of their data, the controller may eitherscenarios:

    Tabled by
    João Oliveira
    Group
    The Left
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  10. 1079 Alternative Julie Rechagneux +7ECR, PfE · ITRE–LIBE “refuse to act on the request, and inform the data subject of the reasons thereof.”

    Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the means at their disposal to enforce the rights conferred by this regulation for purposes otherunrelated thanto the protection of their data, the controller may either:refuse to act on the request, and inform the data subject of the reasons thereof.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  11. 1080 Alternative Pernando Barrena ArzaThe Left · ITRE–LIBE “refuse to act on the request.”

    Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either:refuse to act on the request.

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2026/679 / Article 12 – paragraph 5
  12. 1081 Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “is able to demonstrate an abusive intention where”

    Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests underwhere Articlethe 15controller becauseis able to demonstrate an abusive intention where the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either:

    Tabled by
    Sebastian Tynkkynen, Diego Solier
    Group
    ECR
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  13. 1082 Deletion Pernando Barrena ArzaThe Left · ITRE–LIBE Deletes the Commission’s wording

    (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – point a
  14. 1083 Deletion Julie Rechagneux +7ECR, PfE · ITRE–LIBE Deletes the Commission’s wording

    (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – point a
  15. 1084 Alternative João OliveiraThe Left · ITRE–LIBE “payment of a marginal fee not exceeding the administrative costs of providing the information or communication or taking the action requested; or”

    (a) chargepayment of a reasonablemarginal fee takingnot into accountexceeding the administrative costs of providing the information or communication or taking the action requested; or

    Tabled by
    João Oliveira
    Group
    The Left
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – point a
  16. 1085 Deletion Julie Rechagneux +7ECR, PfE · ITRE–LIBE Deletes the Commission’s wording

    (b) refuse to act on the request.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – point b
  17. 1086 Deletion Pernando Barrena ArzaThe Left · ITRE–LIBE Deletes the Commission’s wording

    (b) refuse to act on the request.

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – point b
  18. 1087 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “A request may in particular be regarded as excessive within the meaning of the first subparagraph where the means at the disposal of the data subject…”

    A request may in particular be regarded as excessive within the meaning of the first subparagraph where the means at the disposal of the data subject are used for the purpose of obtaining commercially sensitive information or gaining insight into the internal processes of the controller, including for the benefit of an undertaking competing with the controller, of exerting pressure in unrelated proceedings, or of disrupting the administrative operations of the controller by imposing a manifestly disproportionate burden.

    Justification

    Specifies the circumstances in which a request may be regarded as excessive: obtaining commercially sensitive information or gaining insight into the internal processes of the controller, including for the benefit of a competing undertaking; exerting pressure in unrelated proceedings; disrupting the administrative operations of the controller by imposing a manifestly disproportionate burden. The criterion is the manifest diversion of purpose, not the mere inconvenience caused to the controller.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – second subparagraph
  19. 1088 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “The exercise of the rights conferred by this Regulation for the purpose of verifying, in good faith, whether a controller complies with this…”

    In Article 12, paragraph 5, the following subparagraph is added

    The exercise of the rights conferred by this Regulation for the purpose of verifying, in good faith, whether a controller complies with this Regulation shall not be regarded as unfounded or excessive, irrespective of whether those rights are exercised individually or with the assistance of, or through, a body referred to in Article 80.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – third subparagraph
  20. 1089 Deletion Henrik DahlEPP · ITRE–LIBE Deletes the Commission’s wording

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.

    Tabled by
    Henrik Dahl
    Group
    EPP
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – last subparagraph
  21. 1090 Deletion Tomas Tobé +2EPP · ITRE–LIBE Deletes the Commission’s wording

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.

    Tabled by
    Tomas Tobé, Arba Kokalari, Jörgen Warborn
    Group
    EPP
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – last subparagraph
  22. 1091 Deletion Niels Flemming HansenEPP · ITRE–LIBE Deletes the Commission’s wording

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.

    Tabled by
    Niels Flemming Hansen
    Group
    EPP
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – last subparagraph
  23. 1092 Deletion Alice Teodorescu MåweEPP · ITRE–LIBE Deletes the Commission’s wording

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.

    Tabled by
    Alice Teodorescu Måwe
    Group
    EPP
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – last subparagraph
  24. 1093 Alternative Pernando Barrena ArzaThe Left · ITRE–LIBE “broad in scope, concerns a long period of time, relates to complex processing operations, concerns profiling or automated decision-making, concerns…”

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request. A request shall not be considered manifestly unfounded or excessive solely because it is broad in scope, concerns a long period of time, relates to complex processing operations, concerns profiling or automated decision-making, concerns several recipients or categories of recipients, concerns possible systemic rights issues, or is made for the purpose of exercising rights under this Regulation or other rights, including consumer protection rights, employment rights, rights to non-discrimination, rights of defence, collective redress, research, journalism, regulatory oversight or civil society monitoring. The manifestly unfounded or excessive character of a request shall be assessed restrictively and on the basis of objective and documented circumstances. It shall not be inferred from the purpose of exercising rights, the use of a representative, the use of standardised requests, the scale or complexity of the processing, or the fact that compliance may require a significant effort by the controller.

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2026/679 / Article 12 – paragraph 5 – last subparagraph
  25. 1094 Alternative João OliveiraThe Left · ITRE–LIBE “effectively, in particular by lodging a complaint with the supervisory authority or by seeking a judicial remedy. The burden of proof regarding…”

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.’The data subject, when making the request, shall be presumed to be acting in the exercise of his or her legitimate interest in defending his or her rights under this Regulation. Any refusal on the grounds that the request is manifestly unfounded or excessive must be substantiated in writing, in a clear, specific and verifiable manner, indicating the objective facts and considerations supporting that conclusion. The justification must be sufficiently detailed to enable the data subject to understand the reasons for the refusal and to challenge it effectively, in particular by lodging a complaint with the supervisory authority or by seeking a judicial remedy. The burden of proof regarding whether the request is manifestly unfounded or excessive shall be on the controller.

    Tabled by
    João Oliveira
    Group
    The Left
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – last subparagraph
  26. 1095 Alternative Nadine MoranoEPP · ITRE–LIBE “of the request and the specific reasons for the request”

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.For the purpose of assessing whether a request is manifestly unfounded or excessive, the controller may ask the data subject to indicate the exact scope of the request and the specific reasons for the request.

    Tabled by
    Nadine Morano
    Group
    EPP
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – last subparagraph
  27. 1096 Addition François-Xavier BellamyEPP · ITRE–LIBE “The Commission may adopt implementing acts to further specify criteria for what constitutes a manifestly unfounded or excessive character of the…”

    In Article 12, paragraph 5, the following subparagraph is added

    The Commission may adopt implementing acts to further specify criteria for what constitutes a manifestly unfounded or excessive character of the request.

    Tabled by
    François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 12(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – last subparagraph

Provisions only Parliament amendments would add or change

7 amendments on 6 units the Commission proposal leaves unchanged

Paragraph 1a (new)New

  1. 1064 Addition Sibylle Berg +1NI · ITRE–LIBE “Where the information referred to in Articles 13 and 14 is provided electronically, a version of that information shall be made available to the data…” numbered 1a

    (5a) the following paragraph is inserted

    1a.Where the information referred to in Articles 13 and 14 is provided electronically, a version of that information shall be made available to the data subject for download in a structured, machine-readable and commonly used file format, in addition to any other form of provision. Simply providing a link to a website, the content of which may be unilaterally altered by the controller, does not satisfy this requirement. The obligation laid down in the first sentence shall be deemed to have been fulfilled if the data subject is offered a file for download which contains the information in full, in an unaltered and permanently retrievable form.’

    Justification

    The principles developed to ensure that mandatory information is accessible to consumers need to be applied to information obligations under data protection law in order to ensure that data subjects can assert and exercise their rights, even retrospectively, for example in the event of a dispute (see recital (new)).

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    GDPR Article 12 – paragraph 1a (new)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 12 – paragraph 1a (new)

Paragraph 2Not amended by the Commission

  1. 1068 Addition Pernando Barrena Arza +1The Left · ITRE–LIBE “The controller shall facilitate the exercise of data subject rights under Articles 15 to 22 of this Regulation. The controller cannot require them to…”

    3a. In Article 12, paragraph 2 is replaced by the following:

    The controller shall facilitate the exercise of data subject rights under Articles 15 to 22 of this Regulation. The controller cannot require them to exercise their rights by particular means or limit their rights by offering restrictive online tools that do not allow to request all information under Article 15(1) to (3). In any case, the controller has to provide and publicly disclose an electronic-mail address which allows data subjects to send requests electronically. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject.

    Justification

    It is up to data subjects how they exercise their rights under the GDPR. They are not bound by any form requirements. Similarly, the controller cannot require data subjects to use a particular form or medium to exercise their rights. This fact should be clarified while it should be required from controllers that they designate an email-address for data subjects who want to electronically exercise their rights. Controllers might also provide online-forms but they should still provide the alternative way of submitting an E-Mail.

    Tabled by
    Pernando Barrena Arza, João Oliveira
    Group
    The Left
    Targets
    GDPR Article 12 – paragraph 2
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 a (new) / Regulation (EU) 2016/679 / Article 12 – paragraph 2

Paragraph 3Not amended by the Commission2 proposals

  1. 47 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “without undue delay and in any event”

    3a. in Article 12, paragraph 3 is replaced by the following:

    3. The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension without undue delay and in any event within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 12 – paragraph 3
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 3 a (new) / Regulation (EU) 2016/679 / Article 12 – paragraph 3
  2. 1069 Addition Angelika WinzigEPP · ITRE–LIBE “The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any…”

    3a. in Article 12, paragraph 3 is replaced by the following:

    The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension without undue delay and in any event within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic means, the information shall be provided by electronic means unless impossible despite the controller’s continuous efforts, unless otherwise requested by the data subject.'

    Tabled by
    Angelika Winzig
    Group
    EPP
    Targets
    GDPR Article 12 – paragraph 3
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 a (new) / Regulation (EU) 2016/679 / Article 12 – paragraph 3

Paragraph 7Not amended by the Commission

  1. 50 Addition Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “In Article 12, paragraphs 7 and 8 are deleted.” numbered 4a

    Effectnew Parliament proposal instruction expressly deletes existing law

    4a.In Article 12, paragraphs 7 and 8 are deleted.

    Justification

    The delegated acts for the purpose of determining the information to be presented by the icons and the procedures for providing standardised icons have never been adopted. Therefore it seems that these paragraphs are no longer needed.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 12 – paragraphs 7 and 8
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 4 a (new) / Regulation (EU) 2016/679 / Article 12 – paragraphs 7 and 8

Paragraph 8Not amended by the Commission

  1. 1097 Addition Markéta GregorováGreens/EFA · ITRE–LIBE “The Commission shall adopt delegated acts in accordance with Article 92 for the purpose of determining the information to be presented by the icons…”

    4a. Article 12, paragraph 8 is replaced by the following

    8.The Commission shall adopt delegated acts in accordance with Article 92 for the purpose of determining the information to be presented by the icons and the procedures for providing standardised icons, after consulting the Board. The Commission shall ensure that the icons cover at least the information requirements on the most common purposes and legal bases used by controllers referred to in Article 13(1)(c). Those delegated acts shall apply by [PO to insert: one year after the entry into force].'

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 12 – paragraph 8
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 a (new) / Regulation (EU) 2016/679 / Article 12 – paragraph 8

Paragraph 8a (new)New

  1. 1098 Addition Angelika Niebler +1EPP · ITRE–LIBE “Where the controller is a SME, the obligations arising under this Chapter and the documentation duties connected with them shall apply in a manner…”

    4a. In Article 12, the following paragraph 8a is added:

    Where the controller is a SME, the obligations arising under this Chapter and the documentation duties connected with them shall apply in a manner proportionate to the size of the enterprise, the nature of the processing and the risk it presents for data subjects. The Board shall issue guidelines setting out simplified means of compliance for such enterprises.'

    Tabled by
    Angelika Niebler, Monika Hohlmeier
    Group
    EPP
    Targets
    GDPR Article 12 – paragraph 8a (new)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 a (new) / Regulation (EU) 2016/679 / Article 12 – paragraph 8a (new)