GDPR· Article 4
Text
Article 4 GDPR as printed in the Council text of 22 October 2026
Definitions
Source Council, 22 October 2026. Article 4: ST 14756/26, page 131 · pp. 131–132 · exact text page
Article 4(1), added sentences Dropped
This Council draft drops the change the Commission proposed. It deletes nothing from the law in force.
Article 4(32) Dropped
Article 4(33) Dropped
Article 4(34) Dropped
Article 4(35) Dropped
Article 4(36) Dropped
Article 4(37) Dropped
Article 4(38)
'scientific research' means any research conducted with the aim of contributing to the growth of society's general knowledge and wellbeing, generating new or complementing existing scientific knowledge, following a methodological and systematic approach consistent with standards of the relevant scientific field, including ethical standards, and producing verifiable and transparent results in an autonomous and independent manner. This does not exclude that the research may also aim to further a commercial interest.’
How each point has changed
| What each text would do to the law in force | ||||||||
|---|---|---|---|---|---|---|---|---|
| Point | Commission19 Nov 2025 | Council21 May 2026 | Council10 Jun 2026 | Council18 Jun 2026 | Council3 Sep 2026 | Council2 Oct 2026 | Council22 Oct 2026 | Parliamentamendments |
| Compared with | law in force | the proposal | 21 May text | 10 Jun text | 18 Jun text | 3 Sep text | 2 Oct text | |
| (1)‘personal data’added sentences · see also Articles 29a and 25a | Amends Changed | No change , back to the law in force since the proposal Back to law in force | No change Unchanged | No change Unchanged | No change Unchanged | No change Unchanged | No change Unchanged | 29 |
| (32)‘terminal equipment’ | Adds Added | Adds Unchanged | Not in the law in force or this text , dropped since 21 May Dropped | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | 2 |
| (33)‘electronic communications networks’ | Adds Added | Not in the law in force or this text , dropped since the proposal Dropped | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | 5 |
| (34)‘web browser’ | Adds Added | Adds Unchanged | Not in the law in force or this text , dropped since 21 May Dropped | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | 1 |
| (35)‘media service’ | Adds Added | Adds Unchanged | Not in the law in force or this text , dropped since 21 May Dropped | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | 1 |
| (36)‘media service provider’ | Adds Added | Adds Unchanged | Not in the law in force or this text , dropped since 21 May Dropped | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | 1 |
| (37)‘online interface’ | Adds Added | Adds Unchanged | Not in the law in force or this text , dropped since 21 May Dropped | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | 1 |
| (38)‘scientific research’ | Adds Added | Adds , rewritten since the proposal Rewritten | Adds Unchanged | Adds Unchanged | Adds , changed since 18 Jun Changed | Adds , changed since 3 Sep Changed | Adds Unchanged | 23 |
| Definitions only Parliament would add or change20 terms, including ‘anonymisation’ and ‘contextual advertising’ | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | Not in the law in force or this text In neither text | 24 |
Each text against the law in force: +Adds adds a provision the law in force lacks~Amends amends the law in force=No change leaves the law in force as it is— neither the law in force nor the text has it changed from the text before
Each text against the text before it: +Added in this text, not in the text before~Changed wording changed~Rewritten under half the earlier wording survives−Dropped drops a provision the text before added↩Back to law in force drops the text before’s change to the law in force=Unchanged same as the text before— in neither text
What each text does
- 19 Nov 2025 Commission proposalCOM(2025) 837 Amends Adds wording to point (1), ‘personal data’, and adds points (32) to (38). Article 4 in this text
- 21 May 2026 Council textST 9547/26 Changed Rewrites point (38), ‘scientific research’, drops point (33), ‘electronic communications networks’, and takes point (1), ‘personal data’ back to the law in force.ST 9547/26 reproduces only some of the proposal’s changes, so this comparison applies only those it shows or visibly drops. It says nothing about the others. Article 4 in this text
- 8 Jun 2026 IMCO draft opinion · Alex Agius Saliba (rapporteur)IMCO-PA-789877 1 amendment to this article. Amendments in this document
- 10 Jun 2026 Council textST 10426/26 Changed Drops points (32) and (34) to (37). Article 4 in this text
- 18 Jun 2026 Council textST 10677/26 Unchanged Same as the text before. Article 4 in this text
- 22 Jun 2026 ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)CJ72-PR-786818 2 amendments to this article. Amendments in this document
- 29 Jun 2026 JURI amendments 69–296 to the draft opinionJURI-AM-790236 6 amendments to this article. Amendments in this document
- 16 Jul 2026 IMCO amendments 329–532 to the draft opinionIMCO-AM-791061 15 amendments to this article. Amendments in this document
- 27 Jul 2026 ITRE–LIBE amendments 777–1052 to the draft reportCJ72-AM-791072 62 amendments to this article. Amendments in this document
- 27 Jul 2026 ITRE–LIBE amendments 1565–1740 to the draft reportCJ72-AM-791874 1 amendment to this article. Amendments in this document
- 3 Sep 2026 Council textST 12535/26 Changed Changes point (38), ‘scientific research’. Article 4 in this text
- 2 Oct 2026 Council textST 13886/26 Changed Changes point (38), ‘scientific research’.Page 126 prints “(9a)” without an instruction or target, so no change can be assigned to that marker. Article 4 in this text
- 22 Oct 2026 Council textST 14756/26 Unchanged Same as the text before. Article 4 in this text
Point (1): ‘Personal data’
Changed by the Commission · back to the law in force on 21 May
The Council texts address identifiability in the pseudonymisation article (Article 29a, later 25a) after withdrawing these sentences on 21 May. See Article 41a
Parliament amendments 29
13 would delete the added sentences, 15 propose alternative wording and 1 would add wording to point (1). Deletion amendments come from The Left, S&D, Greens/EFA, Renew, EPP, ECR, PfE and non-attached members, and from the IMCO rapporteur’s draft opinion.
| Type | The Left | S&D | Greens/EFA | Renew | EPP | ECR | PfE | ESN | NI | Rapporteur |
|---|---|---|---|---|---|---|---|---|---|---|
| − Deletion | 2 | 1 | 2 | 2 | 1 | 1 | 2 | · | 2 | 1 |
| ~ Alternative | · | 1 | · | 1 | 6 | 5 | 1 | 1 | · | · |
| + Addition | · | · | · | · | 1 | · | · | · | · | · |
By political group
- − Deletion The Left 2 S&D 1 Greens/EFA 2 Renew 2 EPP 1 ECR 1 PfE 2 NI 2 Rapporteur 1
- ~ Alternative S&D 1 Renew 1 EPP 6 ECR 5 PfE 1 ESN 1
- + Addition EPP 1
Show
98 −Deletion Alex Agius Saliba (rapporteur)Rapporteur · IMCO Deletes the added sentences
(a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’Justification
Perserving the definition of personal data is essential for the EU’s fundamental rights based approach for European consumers.
- Rapporteur
- Alex Agius Saliba
- Group
- Rapporteur
- Targets
- GDPR Article 4(1), added sentences
- Document
- IMCO draft opinion
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1
233 −Deletion Daniel BudaEPP · JURI Deletes the added sentences
‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’Justification
There is a risk that the Commission’s text will narrow the scope of the concept of ‘personal data’ by linking it to a specific entity’s actual ability to identify the person, with a direct impact on the scope of Regulation (EU) 2016/679 and the fundamental right to data protection. Simplification and competitiveness are necessary, but they cannot be achieved by diminishing the protection of fundamental rights or by introducing legal uncertainty into the application of the GDPR.
- Tabled by
- Daniel Buda
- Group
- EPP
- Targets
- GDPR Article 4(1), added sentences
- Document
- JURI amendments 69–296 to the draft opinion
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 (GDPR) / Article 4 – paragraph 1 – point a
234 ~Alternative Mario MantovaniECR · JURI “If, for the purposes of this paragraph, information is not classified as personal data in respect of a particular data subject, that data subject…”
‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. If, for the purposes of this paragraph, information is not classified as personal data in respect of a particular data subject, that data subject shall not, for the purposes of processing such information, have to comply with the administrative or contractual requirements laid down for the sole purpose of processing personal data under Union data protection law.’
Justification
The clarification that information should only be classified as personal data if the individual can be identified by reasonably available means primarily concerns pseudonymised data. However, this creates uncertainty for data controllers as regards their administrative requirements (e.g. agreements between the data controller and processor, safeguards for data transfers to third countries). For the sake of legal certainty, it is important to clarify that data subjects whose data is not personal in nature should not be subject to requirements relating to the processing of that data.
- Tabled by
- Mario Mantovani
- Group
- ECR
- Targets
- GDPR Article 4(1), added sentences
- Document
- JURI amendments 69–296 to the draft opinion
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – paragraph 1 – point a
235 ~Alternative Ton Diepeveen +1PfE · JURI “considering all objective factors, such as the costs, technological resources and the amount of time required for identification and the safeguards…”
Information relating to a natural person is not necessarily personal data for
every othera person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entitycannotis not reasonably able to identify the natural person to whom the information relates, taking into account the means reasonably likely to be used in practice by that entity, considering all objective factors, such as the costs, technological resources and the amount of time required for identification and the safeguards applied to the processing. Such information does not become personal for that entity merely because the entity which sent the data to that entity or a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.- Tabled by
- Ton Diepeveen, Pascale Piera
- Group
- PfE
- Targets
- GDPR Article 4(1), added sentences
- Document
- JURI amendments 69–296 to the draft opinion
- Source
- Official text, page 135
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 –paragraph 1 – point a
236 ~Alternative Tobiasz Bocheński +1ECR · JURI “including objective factors such as technological resources, safeguards applied during processing, and the time necessary to complete the…”
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity, including objective factors such as technological resources, safeguards applied during processing, and the time necessary to complete the identification process. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.
- Tabled by
- Tobiasz Bocheński, Kosma Złotowski
- Group
- ECR
- Targets
- GDPR Article 4(1), added sentences
- Document
- JURI amendments 69–296 to the draft opinion
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – paragraph 1 – point a
344 −Deletion David CormandGreens/EFA · IMCO Deletes the added sentences
(a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’Justification
There is no substantive impact assessment on changing the definition of personal data, which would have significant effects on protection of consumers and the conduct of businesses in the internal market.
- Tabled by
- David Cormand on behalf of the Verts/ALE Group
- Group
- Greens/EFA
- Targets
- GDPR Article 4(1), added sentences
- Document
- IMCO amendments 329–532 to the draft opinion
- Source
- Official text, page 11
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4
345 −Deletion Kateřina KonečnáNI · IMCO Deletes the added sentences
(a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’Justification
The text proposed by the Commission risks undermining the implementation of the European Health Data Space Regulation in relation to trust on accessing and sharing of personal electronic health data. Weakening the definition of personal data erodes the foundation of trust between doctors and patients — a relationship that ensures clinical data are accurate, complete, and valid. The integrity of the treatment relationship is critical to generating reliable data for safe digital solutions. Weakening the definition does not drive innovation but risks undermining the quality and safety of digital health initiatives.
- Tabled by
- Kateřina Konečná
- Group
- NI
- Targets
- GDPR Article 4(1), added sentences
- Document
- IMCO amendments 329–532 to the draft opinion
- Source
- Official text, page 12
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1
346 −Deletion Virginie JoronPfE · IMCO Deletes the added sentences
‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’- Tabled by
- Virginie Joron
- Group
- PfE
- Targets
- GDPR Article 4(1), added sentences
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4
347 ~Alternative Christian DoleschalEPP · IMCO “considering all objective factors, such as the costs, technological resources and the amount of time required for identification and the safeguards…”
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used in practice by that entity, considering all objective factors, such as the costs, technological resources and the amount of time required for identification and the safeguards applied to the processing. Such information does not become personal for that entity merely because the entity which sent the data to that entity or a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.
- Tabled by
- Christian Doleschal
- Group
- EPP
- Targets
- GDPR Article 4(1), added sentences
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 paragraph 1
348 ~Alternative Piotr MüllerECR · IMCO “In assessing the means reasonably likely to be used by a given entity, account shall be taken of the technical and organisational measures…”
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. In assessing the means reasonably likely to be used by a given entity, account shall be taken of the technical and organisational measures implemented by that entity, including pseudonymisation and privacy-enhancing technologies.
Justification
Confirms that data rendered non identifiable by advanced techniques is not personal data for an entity that cannot re-identify it, narrowing the scope of the GDPR and removing compliance cost for anonymised/pseudonymised processing.
- Tabled by
- Piotr Müller
- Group
- ECR
- Targets
- GDPR Article 4(1), added sentences
- Document
- IMCO amendments 329–532 to the draft opinion
- Source
- Official text, page 14
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1
Show 19 more amendments
928 −Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the added sentences
(a) In point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’- Tabled by
- Sibylle Berg, Martin Sonneborn
- Group
- NI
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 91
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – paragraph 2
929 −Deletion Pernando Barrena ArzaThe Left · ITRE–LIBE Deletes the added sentences
(a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’- Tabled by
- Pernando Barrena Arza
- Group
- The Left
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – second part
930 −Deletion Markéta GregorováGreens/EFA · ITRE–LIBE Deletes the added sentences
(a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’- Tabled by
- Markéta Gregorová on behalf of the Verts/ALE Group
- Group
- Greens/EFA
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – second part
931 −Deletion Irena Joveva +5Renew · ITRE–LIBE Deletes the added sentences
(a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’- Tabled by
- Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
- Group
- Renew
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 93
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – second part
932 −Deletion Marina Kaljurand +8S&D · ITRE–LIBE Deletes the added sentences
(a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’- Tabled by
- Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
- Group
- S&D
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – second part
934 −Deletion João OliveiraThe Left · ITRE–LIBE Deletes the added sentences
‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’- Tabled by
- João Oliveira
- Group
- The Left
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – second part
935 −Deletion Julie Rechagneux +7ECR, PfE · ITRE–LIBE Deletes the added sentences
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.Justification
The Commission introduces into the very definition of personal data the principle that information is not personal for an entity which cannot identify the natural person concerned. This exceeds a technical amendment: it modifies the definition of a fundamental right, restricts the scope of the Regulation and creates legal uncertainty, as both the EDPB and the EDPS have stressed. The relativity of identifiability confirmed by the Court of Justice belongs to the notion of pseudonymisation (Case C-413/23 P, paragraphs 71 to 72), not to Article 4(1). The definition of personal data therefore remains unchanged, and the graded regime introduced in the following amendments provides the legal certainty sought without distorting the Court’s method.
- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – second part
936 −Deletion Irena Joveva +5Renew · ITRE–LIBE Deletes the added sentences
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.- Tabled by
- Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
- Group
- Renew
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – second part
937 ~Alternative Nadine MoranoEPP · ITRE–LIBE “Whether or not information constitutes personal data should be assessed on a case-by-case basis, with regard to each person or entity that holds or…”
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person.Information relating to a natural person does not necessarily constitute personal data for every person or entity, merely because another person or entity can identify that natural person. Whether or not information constitutes personal data should be assessed on a case-by-case basis, with regard to each person or entity that holds or receives that information, taking into account all means reasonably likely to be used by that person or entity to identify the natural person concerned, including the costs, time required and available technology. Information shall not be personal for a given person or entity where that person or entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used.byDepending on the circumstances, pseudonymisation may prevent a person or entity other than the controller from identifying the data subject, such that, for that person or entity, the data subject is not, or is no longer, identifiable.Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’That does not affect the classification of that information as personal data for the controller, nor its obligations under Articles 13 and 14.- Tabled by
- Nadine Morano
- Group
- EPP
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 98
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – second part
938 ~Alternative Francesco Torselli +1ECR · ITRE–LIBE “provided that, where the information refers to economic activities with a high degree of geographical concentration, the combination of geographical…”
Information relating to a natural person
isdoes not necessarily constitute personal data for every other person or entity, merely because another entitycanis able to identify that natural person. Information shall notbeconstitute personal data for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonablylikelyavailable tobe used bythat entity and to third parties operating in the same sector or geographical context. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates, provided that, where the information refers to economic activities with a high degree of geographical concentration, the combination of geographical, production-related and size-related variables is taken into account for the purposes of assessing the resources that can reasonably be made available. (Our intention is to amend part of the article in question)- Tabled by
- Francesco Torselli, Paolo Inselvini
- Group
- ECR
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – second part
939 ~Alternative Dario NardellaS&D · ITRE–LIBE “provided that, where the information refers to economic activities with a high degree of geographical concentration, the combination of geographical…”
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity and by third parties operating in the same sector or geographical area. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates, provided that, where the information refers to economic activities with a high degree of geographical concentration, the combination of geographical, production-related and size-related variables is taken into account for the purposes of assessing the resources that can reasonably be made available.
Justification
La modifica al dispositivo dell’articolo 4, punto 1, del regolamento (UE) 2016/679 è coerente con il correttivo interpretativo introdotto al considerando 27 mediante l’Emendamento 1. Non altera l’impostazione della proposta della Commissione secondo cui un’informazione può non costituire dato personale per una determinata entità in mancanza di mezzi ragionevolmente utilizzabili per l’identificazione; ma vincola tale valutazione all’esame dei mezzi accessibili nel contesto settoriale e territoriale pertinente, evitando che la specificità semantica dei dati generati da attività economiche territorializzate produca un effetto di de-protezione.
- Tabled by
- Dario Nardella
- Group
- S&D
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – second part
940 ~Alternative Aura Salla +6EPP · ITRE–LIBE “Information relating to a natural person is, however, personal data where this”
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.Information relating to a natural person, depending on the circumstances of the case, is not necessarily personal data for every other person or entity, in so far as that person or entity cannot identify that natural person to whom the information relates taking into account the means reasonably likely to be used by that person or entity, Information relating to a natural person is, however, personal data where this information is likely to be put or is put at the disposal of other persons or entities who have the means reasonably likely to enable the data subject to be identified.- Tabled by
- Aura Salla, Ana Miguel Pedro, Adina Vălean, Henrik Dahl, Andrea Wechsler, Pekka Toveri, Christian Ehler
- Group
- EPP
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – second part
941 ~Alternative François-Xavier BellamyEPP · ITRE–LIBE “The means reasonably likely to be used by a specific entity shall be assessed in the light of that entity’s actual technical capabilities, having…”
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. The means reasonably likely to be used by a specific entity shall be assessed in the light of that entity’s actual technical capabilities, having regard to the ressources, costs, available technical means and time required for identification, rather than hypothetical possibilities.
- Tabled by
- François-Xavier Bellamy
- Group
- EPP
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – second part
942 ~Alternative Bart Groothuis +8Renew · ITRE–LIBE “The parameters of a trained AI model do not constitute personal data where, taking into account the means reasonably likely to be used, a natural…”
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. The parameters of a trained AI model do not constitute personal data where, taking into account the means reasonably likely to be used, a natural person whose personal data was processed during training cannot be identified from the model.
Justification
In line with the case law of the Court of Justice of the European Union (ECLI:EU:C:2025:645), the training of an AI model should not be considered as processing of personal data solely on the ground that its output may contain references to personal data. Such an output constitutes the statistically most probable result generated by the model, rather than the retrieval or reproduction of personal data as such.
- Tabled by
- Bart Groothuis, Ivars Ijabs, Morten Løkkegaard, Nikola Minchev, Svenja Hahn, Andreas Glück, Katri Kulmuni, João Cotrim De Figueiredo, Ana Vasconcelos
- Group
- Renew
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – second part
943 ~Alternative Oliver Schenk +12EPP · ITRE–LIBE “That assessment shall take into account objective factors, including but not limited to costs, time, available technology and the legal means…”
Information relating to a natural person, is not
necessarilypersonal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. That assessment shall take into account objective factors, including but not limited to costs, time, available technology and the legal means available to that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.- Tabled by
- Oliver Schenk, Axel Voss, Marie-Sophie Lanig, Ana Miguel Pedro, Romana Tomc, Marion Walsmann, Lena Düpont, Andrea Wechsler, François-Xavier Bellamy, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal
- Group
- EPP
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 103
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – second part
944 ~Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “through technical and organisational measures, as well as state of the art technology available to”
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used
bythrough technical and organisational measures, as well as state of the art technology available to that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.- Tabled by
- Sebastian Tynkkynen, Diego Solier
- Group
- ECR
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – second part
945 ~Alternative Mary KhanESN · ITRE–LIBE “The controller shall bear the burden of demonstrating that the risk of re-identification is objectively insignificant, taking into account the state…”
‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity.When determining whether a natural person is identifiable, account shall be taken of all the means reasonably likely to be used by the controller, an actual or foreseeable recipient or any other actor in the processing chain. Pseudonymised data remains personal data, provided that re-identification by an actual or foreseeable recipient is legally and practically possible.Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’The controller shall bear the burden of demonstrating that the risk of re-identification is objectively insignificant, taking into account the state of the art, available additional information and the intended audiences. A contractual ban on re-identification alone shall not suffice.Justification
Protection must not depend on whether an individual actor claims at any given time that they are unable to identify themselves. What matters is the real risk throughout the entire processing chain.
- Tabled by
- Mary Khan
- Group
- ESN
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – paragraph 2
946 ~Alternative Alice Teodorescu MåweEPP · ITRE–LIBE “the processing is merely transitory in nature; and (b) the processing is for a purpose that is unrelated to the data subject as an identified or…”
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person.Regulation (EU) 2016/679 shall not apply to the processing of personal data, including sensitive personal data, where: (a) the processing is merely transitory in nature; and (b) the processing is for a purpose that is unrelated to the data subject as an identified or identifiable natural person; and (c) appropriate technical and/or organisational safeguards are in place to prevent any use of the data for a purpose related to the data subject as an identified or identifiable natural person up to the point when the data are irreversibly anonymised or erased.Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.- Tabled by
- Alice Teodorescu Måwe
- Group
- EPP
- Targets
- GDPR Article 4(1), added sentences
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 105
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – second part
947 +Addition Alice Teodorescu MåweEPP · ITRE–LIBE “Data shall not be considered as personal data within the meaning of Regulation (EU) 2016/679 and other Union and national law referring to or relying…”
In Article 4, point 1, the following part is added
Data shall not be considered as personal data within the meaning of Regulation (EU) 2016/679 and other Union and national law referring to or relying on the notion of personal data within the meaning of Regulation (EU) 2016/679 insofar as:
(a)the data relate primarily to an entity other than a natural person, such as an enterprise or an object, and the data subject is associated with that entity exclusively as owner, employee or in a similar function; and
(b)processing of the data is for a purpose that is not specifically related to the data subject as an identified or identifiable natural person; and
(c)appropriate technical and/or organisational safeguards are in place to prevent any use of the data for a purpose specifically related to the data subject as an identified or identifiable natural person.
- Tabled by
- Alice Teodorescu Måwe
- Group
- EPP
- Targets
- GDPR Article 4 – point 1 – third part (new)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 1 – third part (new)
Points (32) to (37)
New definitions proposed by the Commission · dropped by the Council on 10 June, (33) on 21 May
‘terminal equipment’
‘electronic communications networks’
‘web browser’
‘media service’
‘media service provider’
‘online interface’
Point (38): ‘Scientific research’
New definition proposed by the Commission · rewritten by the Council on 21 May · changed on 3 September · changed on 2 October
Parliament amendments 23
4 would delete the definition and 19 propose alternative wording. Deletion amendments come from The Left and Greens/EFA. 4 more, which add new definitions, are listed by term.
| Type | The Left | S&D | Greens/EFA | Renew | EPP | ECR | PfE | ESN | NI |
|---|---|---|---|---|---|---|---|---|---|
| − Deletion | 3 | · | 1 | · | · | · | · | · | · |
| ~ Alternative | · | 2 | 1 | 2 | 7 | 4 | 2 | 1 | 1 |
By political group
- − Deletion The Left 3 Greens/EFA 1
- ~ Alternative S&D 2 Greens/EFA 1 Renew 2 EPP 7 ECR 4 PfE 2 ESN 1 NI 1
Show
232 −Deletion Arash SaeidiThe Left · JURI Deletes the definition
1. Article 4 is amended as follows: (a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’ (32) ‘terminal equipment’ means terminal equipment as set out in Article 1(1) of Directive 2008/63/EC; (33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply; (34) ‘web browser’ means web browser as defined in Article 2(11) of Regulation (EU) 2022/1925; (35) ‘media service’ means a media service as defined in Article 2(1) of Regulation (EU) 2024/1083; (36) ‘media service provider’ means a media service provider as defined in Article 2(2) of Regulation (EU) 2024/1083;’ (37) ‘online interface’ means an online interface as defined in Article 3(m) of Regulation (EU) 2022/2065.’ (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.’- Tabled by
- Arash Saeidi
- Group
- The Left
- Targets
- GDPR Article 4(38)
- Document
- JURI amendments 69–296 to the draft opinion
- Printed header
- Article 3 – paragraph 1 – point 1 / Regulation (EU) 2016/679 / Article 3 – paragraph 1 – point 1 – introductory part
237 ~Alternative Daniel BudaEPP · JURI “in full compliance with the provisions of this Regulation with regard to the protection of personal data, including through the implementation of…”
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest, in full compliance with the provisions of this Regulation with regard to the protection of personal data, including through the implementation of appropriate technical and organisational measures, such as pseudonymisation, where possible.’ No provision of this definition may be construed as limiting the rights of data subjects provided for in this Regulation.
- Tabled by
- Daniel Buda
- Group
- EPP
- Targets
- GDPR Article 4(38)
- Document
- JURI amendments 69–296 to the draft opinion
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation 2016/679 / Article 4 – point 38
349 −Deletion David CormandGreens/EFA · IMCO Deletes the definition
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.Justification
Due to the lack of impact assessment such a change is not adequately justified and therefore should not be proposed unless potential consequences on consumers and businesses in the internal market are clear.
- Tabled by
- David Cormand on behalf of the Verts/ALE Group
- Group
- Greens/EFA
- Targets
- GDPR Article 4(38)
- Document
- IMCO amendments 329–532 to the draft opinion
- Source
- Official text, page 15
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4
350 ~Alternative Virginie JoronPfE · IMCO “Scientific research shall not include the profiling of natural persons, direct marketing, monitoring the behaviour of individuals or activities aimed…”
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. Scientific research shall not include the profiling of natural persons, direct marketing, monitoring the behaviour of individuals or activities aimed at influencing or directing the behaviour of natural persons, even if these activities use scientific methods.
- Tabled by
- Virginie Joron
- Group
- PfE
- Targets
- GDPR Article 4(38)
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
351 ~Alternative Piotr MüllerECR · IMCO “An activity does not lose its scientific research character solely because it is privately funded, is carried out within a commercial undertaking or…”
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. An activity does not lose its scientific research character solely because it is privately funded, is carried out within a commercial undertaking or because the results of that research are subsequently used for commercial activities.
Justification
Confirms that private funding or a commercial dimension does not disqualify scientific research.
- Tabled by
- Piotr Müller
- Group
- ECR
- Targets
- GDPR Article 4(38)
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
352 ~Alternative Arba KokalariEPP · IMCO “research testing or development of AI systems or AI models prior to their being placed on”
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area.
This does not exclude that the research may also aim to further a commercial interest.This does not exclude research testing or development of AI systems or AI models prior to their being placed on the market or put into service or the aim to further a commercial interest.- Tabled by
- Arba Kokalari
- Group
- EPP
- Targets
- GDPR Article 4(38)
- Document
- IMCO amendments 329–532 to the draft opinion
- Source
- Official text, page 17
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4
959 −Deletion João OliveiraThe Left · ITRE–LIBE Deletes the definition
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.’- Tabled by
- João Oliveira
- Group
- The Left
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 111
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
960 −Deletion Pernando Barrena ArzaThe Left · ITRE–LIBE Deletes the definition
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.- Tabled by
- Pernando Barrena Arza
- Group
- The Left
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 112
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2026/679 / Article 4 – point 38
961 ~Alternative Alex Agius SalibaS&D · ITRE–LIBE “ethical standards in the relevant research field, including the respect for human autonomy and the concept of consent to participate in research…”
(38)
“scientific research” means any research which can also support innovation, such as technological development and demonstration.“scientific research” means any research which: a. follows a methodical and systematic approach; b.These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area.adheres to ethical standards in the relevant research field, including the respect for human autonomy and the concept of consent to participate in research, transparency, accountability and oversight; c. is genuinely intended to produce verifiable and transparent results; d. is autonomous and independent and not subject to undue external influence; e. is carried out with the genuine19 aim of contributing to the growth of society’s general knowledge and wellbeing, which does not exclude subsequent commercial interests and; f. has the potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways.This does not exclude that the research may also aim to further a commercial interest.Justification
Based on EDPB guidelines 1/2026 on processing of personal data for scientific research purposes of April 2026.
- Tabled by
- Alex Agius Saliba
- Group
- S&D
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
962 ~Alternative Julie Rechagneux +7ECR, PfE · ITRE–LIBE “Scientific research shall not include the profiling of natural persons, direct marketing, the monitoring of individuals' behaviour, or activities…”
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. Scientific research shall not include the profiling of natural persons, direct marketing, the monitoring of individuals' behaviour, or activities whose purpose is to influence or nudge the behaviour of natural persons, even where such activities apply scientific methods.
- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
Show 13 more amendments
963 ~Alternative Bart Groothuis +8Renew · ITRE–LIBE “The development, training, testing and validation of new technologies, such as AI systems, AI models and AI agents may be topics of scientific…”
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. The development, training, testing and validation of new technologies, such as AI systems, AI models and AI agents may be topics of scientific research where it meets the conditions of this point.
Justification
Clarifying that the development of new technologies, such as the training of an LLM, may also be considered as scientific research.
- Tabled by
- Bart Groothuis, Ivars Ijabs, Morten Løkkegaard, Nikola Minchev, Svenja Hahn, Andreas Glück, Katri Kulmuni, João Cotrim De Figueiredo, Ana Vasconcelos
- Group
- Renew
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
964 ~Alternative Tomas Tobé +2EPP · ITRE–LIBE “research testing or development of AI systems or AI models prior to their being placed on”
(38) “scientific research” means any research which can also support innovation, such as technological development, demonstration, applied research and
demonstrationprivately funded research. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area.This does not exclude that the research may also aim to further a commercial interest.This does not exclude research testing or development of AI systems or AI models prior to their being placed on the market or put into service or the aim to further a commercial interest.- Tabled by
- Tomas Tobé, Arba Kokalari, Jörgen Warborn
- Group
- EPP
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 115
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
965 ~Alternative Marina Kaljurand +8S&D · ITRE–LIBE “to the public interest or to serve the mankind, generating new or complementing existing scientific knowledge, following a methodological”
(38)
“scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area.“scientific research” means research conducted in an autonomous and independent manner, with the aim of contributing to the growth of society’s public knowledge, to the public interest or to serve the mankind, generating new or complementing existing scientific knowledge, following a methodological and systematic approach consistent with generally recognised ethical standards, including the respect for human autonomy and the concept of consent to participate in research, as well as standards applicable in the relevant scientific field, producing evidence-based, testable, transparent and published results.This does not exclude that the research may also aim to further a commercial interest.- Tabled by
- Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
- Group
- S&D
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
966 ~Alternative Henrik DahlEPP · ITRE–LIBE “or development activity regarding AI systems or AI models prior to their being placed on the market or put into service or the”
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area.
This does not exclude that the research may also aim to further a commercial interest.This does not exclude the research testing or development activity regarding AI systems or AI models prior to their being placed on the market or put into service or the aim to further a commercial interest.- Tabled by
- Henrik Dahl
- Group
- EPP
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
967 ~Alternative Irena Joveva +5Renew · ITRE–LIBE “producing verifiable and transparent results”
(38)
“scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.“scientific research” means any research conducted in autonomous and independent manner, with the aim of contributing to the growth of society’s general knowledge and wellbeing, adhere to recognised ethical standards for scientific research in the public interest, with respect to human autonomy and producing verifiable and transparent results.- Tabled by
- Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
- Group
- Renew
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 117
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
968 ~Alternative Markéta GregorováGreens/EFA · ITRE–LIBE “research that follows a methodical and systematic approach, adheres to all ethical and other standards in the relevant”
(38)
“scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area.“scientific research” means research that follows a methodical and systematic approach, adheres to all ethical and other standards in the relevant research field, is able to produce verifiable and transparent results, and is carried out in an autonomous and independent manner with the genuine objective of contributing to the growth of society’s general knowledge.This does not exclude that the research may also aim to further a commercial interest.Justification
based on EDPB-EDPS Joint Opinion and EDPB Guidelines 1/2026, section 2.1
- Tabled by
- Markéta Gregorová on behalf of the Verts/ALE Group
- Group
- Greens/EFA
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
969 ~Alternative Sibylle Berg +1NI · ITRE–LIBE ‘scientific research’ means any research which can also support innovation, such as technological development and demonstration. These actions shall…
38. “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area.
This does not exclude that the research may also aim to further a commercial interest.- Tabled by
- Sibylle Berg, Martin Sonneborn
- Group
- NI
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
970 ~Alternative Aura Salla +7EPP · ITRE–LIBE “the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new”
(38)
“scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area.“scientific research” means creative and systematic work undertaken in order to increase the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts without any particular application or use in view, or through original investigation undertaken in order to acquire new knowledge directed primarily towards a specific, practical aim or objective. This does not exclude that the research may also aim to further a commercial interest.- Tabled by
- Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Adina Vălean, Andrea Wechsler, Oliver Schenk, Pekka Toveri, Christian Ehler
- Group
- EPP
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 119
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
971 ~Alternative Oliver Schenk +13EPP · ITRE–LIBE “the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new”
(38)
“scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area.“scientific research” means creative and systematic work undertaken in order to increase the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts without any particular application or use in view, or through original investigation undertaken in order to acquire new knowledge directed primarily towards a specific, practical aim or objective. This does not exclude that the research may also aim to further a commercial interest.- Tabled by
- Oliver Schenk, Marie-Sophie Lanig, Axel Voss, Ana Miguel Pedro, Romana Tomc, Marion Walsmann, Lena Düpont, Andrea Wechsler, François-Xavier Bellamy, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Aura Salla
- Group
- EPP
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
972 ~Alternative Ondřej KrutílekECR · ITRE–LIBE “including scientific methods”
(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards, including scientific methods, in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.
Justification
Generally, the definition should not be too restrictive and prevent innovation. Scientific research is foremostly defined by using scientific methods, which should be explicitly mentioned. The definition should not include restrictive conditions linked to the specific entity conducting the scientific research. The qualification of an activity as scientific research should depend on the nature of the research itself, rather than on the characteristics or status of the organisation carrying it out.
- Tabled by
- Ondřej Krutílek
- Group
- ECR
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
973 ~Alternative Mary KhanESN · ITRE–LIBE “General product development, targeted advertising, profiling, data trading”
38.
“scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. they shall be carried out with the aim of contributing to the development of the general knowledge and well-being of society, while respecting ethical standards in the field of research concerned.“scientific research” means methodologically systematic, traceable and accountable research that is carried out in accordance with recognised scientific and ethical standards, follows a documented research agenda and serves the advancement of knowledge or a clearly defined public interest. A commercial interest does not preclude scientific research if it is secondary to the purpose of the research. General product development, targeted advertising, profiling, data trading and the training of general AI systems or AI models are not considered scientific research in themselves.This does not exclude that the research may also aim to further a commercial interest.’Justification
Research privileges are intended for genuine science, not to be used as a blanket legal basis for commercial data exploitation.
- Tabled by
- Mary Khan
- Group
- ESN
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 121
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
974 ~Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE ‘scientific research’ means any research which can also support competitiveness, innovation, such as technological development and demonstration.…
(38) “scientific research” means any research which can also support competitiveness, innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.
- Tabled by
- Sebastian Tynkkynen, Diego Solier
- Group
- ECR
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
975 ~Alternative Axel VossEPP · ITRE–LIBE “demonstration, fundamental research, applied research”
(38)
“scientific research” means any research which can also support innovation, such as technological development and demonstration.“scientific research” means any research activity including technological development demonstration, fundamental research, applied research and privately funded research. These actions shall contribute to existing scientific knowledgeor, apply to existing knowledge in novel ways, or be carried out with the aim of contributing to the growth of society’s general knowledgeandor wellbeingand adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.Justification
Scientific research should be defined by its purpose, methodology and contribution to knowledge, not by whether it is carried out by academia, public bodies or companies. The amendment codifies the broad approach already reflected in GDPR Recital 159, covering technological development, demonstration, fundamental, applied and privately funded research. Commercial interest alone should not exclude genuine research from the GDPR research framework or Article 89 safeguards.
- Tabled by
- Axel Voss
- Group
- EPP
- Targets
- GDPR Article 4(38)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38
Definitions only Parliament amendments would add or change
24 amendments: 22 propose new definitions, 2 amend definitions the Commission leaves unchanged
‘anonymisation’New definition2 proposals
977 +Addition Irena Joveva +5Renew · ITRE–LIBE ‘anonymisation’ is the process of rendering personal data anonymous, which means a processing operation that removes any relationship between data… numbered (38a)
(38a)‘anonymisation’ is the process of rendering personal data anonymous, which means a processing operation that removes any relationship between data and an identified or identifiable natural person (‘data subject’); To determine whether a natural person is identifiable, account should be taken of all the means that can be used now or in the foreseeable future, such as singling out, either by the controller or by any other person to identify the natural person directly or indirectly.
- Tabled by
- Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
- Group
- Renew
- Targets
- GDPR Article 4 – point 38a (new)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 124
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38a (new)
1605 +Addition Andrea Wechsler +7EPP · ITRE–LIBE ‘anonymisation’ means the processing of personal data in such a manner that the resulting information does not or no longer constitute personal data… numbered (5a)
In Article 4, the following point 5a is inserted
"'(5a) ‘anonymisation’ means the processing of personal data in such a manner that the resulting information does not or no longer constitute personal data for the controller or recipient concerned because the natural person to whom the information relates cannot be identified by means reasonably likely to be used by that controller or recipient, taking into account all objective factors and the means and criteria referred to in Article 41a;'
Wider passage printed with the amendment
Article 4Definitions
For the purposes of this Regulation:
(1)‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
(2)‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
(3)‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future;
(4)‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
- Tabled by
- Andrea Wechsler, Marie-Sophie Lanig, Stefan Köhler, Alexandra Mehnert, Angelika Niebler, Verena Mertens, Christian Doleschal, Sabine Verheyen
- Group
- EPP
- Targets
- GDPR Article 4 – point 5a (new)
- Document
- ITRE–LIBE amendments 1565–1740 to the draft report
- Printed header
- Article 3 c (new) / Regulation (EU) 2016/679 / Article 4 – point 5a (new)
‘contextual advertising’New definition
353 +Addition David CormandGreens/EFA · IMCO ‘contextual advertising’ means the selection and display of non-personalised advertisements based solely on the content or contextual environment of… numbered (38a)
(38a)‘contextual advertising’ means the selection and display of non-personalised advertisements based solely on the content or contextual environment of a single web page, application or search query accessed or viewed by the data subject at a given moment without processing any personal data of the data subject current, past or future behaviour, including but not limited to browsing history, profiles, or activity across websites, applications, search queries and location data
- Tabled by
- David Cormand on behalf of the Verts/ALE Group
- Group
- Greens/EFA
- Targets
- GDPR Article 4 – point 38a (new)
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4
‘data concerning health’Amends existing point (15)
948 +Addition Oliver Schenk +12EPP · ITRE–LIBE ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care…
(15)‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status; Data that merely allow such information to be inferred indirectly shall not be considered data concerning health;
- Tabled by
- Oliver Schenk, Axel Voss, Marie-Sophie Lanig, Ana Miguel Pedro, Romana Tomc, Marion Walsmann, Lena Düpont, François-Xavier Bellamy, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal
- Group
- EPP
- Targets
- GDPR Article 4 – point 15
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point a / Regulation (EU) 2016/679 / Article 4 – point 15
‘electronic communications content data’New definition
989 +Addition Marina Kaljurand +8S&D · ITRE–LIBE ‘electronic communications content data’ means any data transmitted, distributed or exchanged by means of electronic communications services, in a…
(38d)‘electronic communications content data’ means any data transmitted, distributed or exchanged by means of electronic communications services, in a digital format, such as text, voice, videos, images and sound. Where metadata of other electronic communications services or protocols are transmitted, distributed or exchanged by using the respective service, they shall be considered electronic communications content for the respective service.
Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
- Tabled by
- Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
- Group
- S&D
- Targets
- GDPR Article 4 – point 38d (new)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38d (new)
‘electronic communications data’New definition
984 +Addition Marina Kaljurand +8S&D · ITRE–LIBE ‘electronic communications data’ means electronic communications content data and metadata; numbered (38b)
(38b)‘electronic communications data’ means electronic communications content data and metadata;
Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
- Tabled by
- Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
- Group
- S&D
- Targets
- GDPR Article 4 – point 38b (new)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38b (new)
‘electronic communications metadata’New definition
985 +Addition Marina Kaljurand +8S&D · ITRE–LIBE ‘electronic communications metadata’ means data processed in an electronic communications network for the purposes of transmitting, distributing or… numbered (38c)
(38c)‘electronic communications metadata’ means data processed in an electronic communications network for the purposes of transmitting, distributing or exchanging electronic communications content, including data used to trace and identify the source and destination of a communication or another type of interaction, data on the location of the terminal equipment or user, data processed or generated in the context of providing services, including additional information about the service, and the date, time, duration and the type of communication, size, route, format and the protocol used and the type of compression.
Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
- Tabled by
- Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
- Group
- S&D
- Targets
- GDPR Article 4 – point 38c (new)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 128
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38c (new)
‘free and open-source software’New definition
983 +Addition Markéta GregorováGreens/EFA · ITRE–LIBE ‘free and open-source software’ means free and open-source software as defined in Article 3(48) of Regulation (EU) 2024/2847. numbered (38b)
(38b)‘free and open-source software’ means free and open-source software as defined in Article 3(48) of Regulation (EU) 2024/2847.
- Tabled by
- Markéta Gregorová on behalf of the Verts/ALE Group
- Group
- Greens/EFA
- Targets
- GDPR Article 4 – point 38b (new)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 127
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38b (new)
‘identifiable natural person’New definition2 proposals
354 +Addition Virginie JoronPfE · IMCO ‘identifiable natural person’ means a natural person who can be identified, either directly or indirectly, when account is taken of all relevant… numbered (38a)
(38a)‘identifiable natural person’ means a natural person who can be identified, either directly or indirectly, when account is taken of all relevant means that might reasonably be used;
- Tabled by
- Virginie Joron
- Group
- PfE
- Targets
- GDPR Article 4(38)
- Document
- IMCO amendments 329–532 to the draft opinion
- Source
- Official text, page 18
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38 a
979 +Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE ‘identifiable natural person’ means a natural person who can be identified, directly or indirectly, taking into account all the means reasonably… numbered (38a)
(38a)‘identifiable natural person’ means a natural person who can be identified, directly or indirectly, taking into account all the means reasonably likely to be used;
- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- GDPR Article 4 – point 38a (new)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 125
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38a (new)
‘large controller’New definition
981 +Addition Axel VossEPP · ITRE–LIBE ‘large controller’ means a controller, if: it processed personal data of more than [50 000 000] or more than [33]% of the population of any given… numbered (38b)
(38b)‘large controller’ means a controller, if:
(a)it processed personal data of more than [50 000 000] or more than [33]% of the population of any given Member State in the pending or preceding financial year, or
(b)if it was designated a gatekeeper under Article 3 of Regulation (EU) 2022/1925 or a very large online platform or very large online search engine under Article 33 of Regulation (EU) 2022/2065.
Justification
RISK-BASED APPROACH #6: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
- Tabled by
- Axel Voss
- Group
- EPP
- Targets
- GDPR Article 4 – point 38b (new)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38b (new)
‘manufacturer’New definition
980 +Addition Markéta GregorováGreens/EFA · ITRE–LIBE ‘manufacturer’ means a manufacturer within the meaning of Article 4 of Directive (EU) 2024/2853 of the European Parliament and of the Council. numbered (38a)
(38a)‘manufacturer’ means a manufacturer within the meaning of Article 4 of Directive (EU) 2024/2853 of the European Parliament and of the Council.
- Tabled by
- Markéta Gregorová on behalf of the Verts/ALE Group
- Group
- Greens/EFA
- Targets
- GDPR Article 4 – point 38a (new)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 125
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38a (new)
‘medium controller’New definition
987 +Addition Axel VossEPP · ITRE–LIBE ‘medium controller’ means any controller that is not a small controller or large controller. numbered (38c)
(38c)‘medium controller’ means any controller that is not a small controller or large controller.
Justification
RISK-BASED APPROACH #7: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
- Tabled by
- Axel Voss
- Group
- EPP
- Targets
- GDPR Article 4 – point 38c (new)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 129
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38c (new)
‘mobile application’New definition
355 +Addition David CormandGreens/EFA · IMCO ‘mobile application’ means application software designed and developed for use by the general public on mobile devices such as smartphones and… numbered (38b)
(38b)‘mobile application’ means application software designed and developed for use by the general public on mobile devices such as smartphones and tablets. It does not include the software that controls those devices (mobile operating systems) or hardware;
- Tabled by
- David Cormand on behalf of the Verts/ALE Group
- Group
- Greens/EFA
- Targets
- GDPR Article 4 – point 38b (new)
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4
‘non-identifiable natural person’New definition2 proposals
356 +Addition Virginie JoronPfE · IMCO ‘non-identifiable natural person’, in relation to a given entity, means a natural person that cannot be identified by this entity when account is…
(38b)‘non-identifiable natural person’, in relation to a given entity, means a natural person that cannot be identified by this entity when account is taken of all relevant means that might reasonably be used by this entity;
- Tabled by
- Virginie Joron
- Group
- PfE
- Targets
- GDPR Article 4(38)
- Document
- IMCO amendments 329–532 to the draft opinion
- Source
- Official text, page 19
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38 b
982 +Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE ‘non-identifiable natural person’, for a given entity, means a natural person whom that entity cannot identify taking into account the means…
(38b)'non-identifiable natural person’, for a given entity, means a natural person whom that entity cannot identify taking into account the means reasonably likely to be used by that entity.
- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- GDPR Article 4 – point 38b (new)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38b (new)
‘operating system’New definition
955 +Addition Marina Kaljurand +8S&D · ITRE–LIBE ‘operating system’ means a system software as defined in Article 2(10) of Regulation (EU) 2022/1925; numbered (34a)
(34a)‘operating system’ means a system software as defined in Article 2(10) of Regulation (EU) 2022/1925;
- Tabled by
- Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
- Group
- S&D
- Targets
- GDPR Article 4 – point 34a (new)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 34a (new)
‘pseudonymisation’Amends existing point (5)
933 ~Alternative Julie Rechagneux +7ECR, PfE · ITRE–LIBE “Pseudonymisation does not form part of the definition of personal data laid down in point (1). Personal data which have undergone pseudonymisation…”
Tracker noteThis amendment moves the Commission’s instruction from point (1) to point (5) and proposes its own wording there. Whether the Commission’s original wording for point (1) would still be added has not been established, so no amended version of the article is shown.
(a) in point
15, the following sentences are added:Pseudonymisation does not form part of the definition of personal data laid down in point (1).
Personal data which have undergone pseudonymisation and which could be attributed to a natural person by the use of additional information remain personal data for the controller holding that additional information, and cannot as such be regarded as anonymised.
However, where personal data which have undergone pseudonymisation are made available to another entity, they may cease to be personal data in relation to that entity where the technical and organisational measures referred to in the first subparagraph effectively prevent that entity from attributing the data to the data subject, provided that:
(a)that entity is not in a position to circumvent those measures in the course of any processing carried out under its control; and
(b)those measures also prevent that entity from attributing the data to the data subject by other means reasonably likely to be used, including by combination with other information available to it.
Where it cannot be excluded that the data will be further transmitted to third parties reasonably likely to be able to attribute them to the data subject, the data shall be regarded as personal data in respect of that transmission and of any subsequent processing by those third parties.
Justification
Codifies the judgment of the Court of Justice in Case C-413/23 P (EDPS v SRB) at the place where the Court itself situated it. Pseudonymisation does not form part of the definition of personal data (paragraph 72). Pseudonymised data remain personal data for the controller holding the additional information (paragraph 76) and cannot as such be regarded as anonymised (paragraph 73). They may, however, not be regarded as personal data in relation to a recipient where the technical and organisational measures have been effectively implemented and prevent that recipient from attributing the data to the data subject, including by combination with other information, so that the risk of identification is insignificant (paragraphs 75, 77 and 82). Where onward transmission to third parties able to re-identify cannot be excluded, the data remain personal data (paragraph 85).
- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- GDPR Article 4 – point 5
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point a – introductory part / Regulation (EU) 2016/679 / Article 4 – point 5
‘pseudonymised data’New definition2 proposals
357 +Addition Virginie JoronPfE · IMCO ‘pseudonymised data’ means personal data having undergone privacy-enhancing technical, organisational or cryptographic measures designed to prevent… numbered (38c)
(38c)‘pseudonymised data’ means personal data having undergone privacy-enhancing technical, organisational or cryptographic measures designed to prevent the likelihood of the data being assigned to a specific natural person while preserving their value for lawful processing purposes; it differs from anonymisation, which renders the data subject non-identifiable or more identifiable;
- Tabled by
- Virginie Joron
- Group
- PfE
- Targets
- GDPR Article 4(38)
- Document
- IMCO amendments 329–532 to the draft opinion
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38 c
986 +Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE ‘pseudonymised data’ means personal data that have undergone technical, organisational or cryptographic privacy-enhancing measures designed to… numbered (38c)
(38c)‘pseudonymised data’ means personal data that have undergone technical, organisational or cryptographic privacy-enhancing measures designed to prevent the likelihood of attribution to a specific natural person while preserving their utility for lawful processing purposes, by contrast with anonymisation, which renders the data subject not or no longer identifiable.
- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- GDPR Article 4 – point 38c (new)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38c (new)
‘small controller’New definition
976 +Addition Axel VossEPP · ITRE–LIBE ‘small controller’ means any controller, if: the processing of personal data is not a core business activity of the controller, does not process… numbered (38a)
(38a)‘small controller’ means any controller, if:
(a)the processing of personal data is not a core business activity of the controller,
(b)does not process special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10 as part of another core business activity of the controller, a department or branch of the controller and
(c)the controller processes personal data of less than [100 000] data subjects in the pending or preceding financial year.
Justification
RISK-BASED APPROACH #5: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.
- Tabled by
- Axel Voss
- Group
- EPP
- Targets
- GDPR Article 4 – point 38a (new)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 123
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38a (new)
‘state-of-the-art privacy-preserving and privacy-enhancing methods’New definition
988 +Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE ‘state-of-the-art privacy-preserving and privacy-enhancing methods’ means recognised technical and organisational methods reflecting the state of the… numbered (38d)
(38d)‘state-of-the-art privacy-preserving and privacy-enhancing methods’ means recognised technical and organisational methods reflecting the state of the art that reduce or eliminate the attribution of data to a natural person, including pseudonymisation and key separation, encryption, aggregation and generalisation, the addition of statistical noise and differential privacy, synthetic data generation, secure multi-party computation and the use of secure processing environments.
Justification
Defines the recognised privacy-enhancing techniques on which the graded regime rests: pseudonymisation and key separation, encryption at rest and in transit, aggregation and generalisation, statistical noise and differential privacy, synthetic data, secure multi-party computation, secure processing environments, and contractual and organisational prohibitions on re-identification. The technical criteria are to be specified by implementing act, in cooperation with the EDPB, so as not to freeze in the Regulation a state of the art which is bound to evolve.
- Tabled by
- Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
- Group
- ECR, PfE
- Targets
- GDPR Article 4 – point 38d (new)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Source
- Official text, page 130
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38d (new)
‘state-of-the-art privacy-preserving and privacy-strengthening methods’New definition
358 +Addition Virginie JoronPfE · IMCO ‘state-of-the-art privacy-preserving and privacy-strengthening methods’ means recognised technical and organisational methods which reflect the state… numbered (38d)
(38d)‘state-of-the-art privacy-preserving and privacy-strengthening methods’ means recognised technical and organisational methods which reflect the state of the art and which reduce or eliminate the possibility that data may be attributed to a natural person, including pseudonymisation and the separation of keys, encryption, aggregation and generalisation, the addition of statistical noise and differential privacy, synthetic data generation, secure multi-party computation and use of secure processing environments.
- Tabled by
- Virginie Joron
- Group
- PfE
- Targets
- GDPR Article 4(38)
- Document
- IMCO amendments 329–532 to the draft opinion
- Source
- Official text, page 20
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – paragraph 38 d
‘user’New definition
978 +Addition Marina Kaljurand +8S&D · ITRE–LIBE ‘user’ means a natural or legal person using or requesting a publicly available electronic communications service as defined in Article 2(14) of… numbered (38a)
(38a)‘user’ means a natural or legal person using or requesting a publicly available electronic communications service as defined in Article 2(14) of Directive (EU) 2018/1972;
Justification
This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.
- Tabled by
- Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
- Group
- S&D
- Targets
- GDPR Article 4 – point 38a (new)
- Document
- ITRE–LIBE amendments 777–1052 to the draft report
- Printed header
- Article 3 – paragraph 1 – point 1 – point b / Regulation (EU) 2016/679 / Article 4 – point 38a (new)