Digital Omnibus tracker

GDPR · Regulation (EU) 2016/679

Article 41a

Compare the available Commission, Council and Parliament texts and amendments affecting this article.

Article total: 16 parts · 4 Council drafts · 65 Parliament amendments

Removed wording is struck through; added or replacement wording is highlighted.

Institutional text

European Commission proposal

All Commission’s changes to GDPR

The wording proposed by the Commission at the start of this legislative file.

Full article with Commission changes

Article with proposed changes

Official consolidated text dated 4 May 2016, with the Commission proposal change affecting this article applied.

Article 41a

  1. 1.

    The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.

  2. 2.

    For the purpose of paragraph 1 the Commission shall:

    1. (a)

      assess the state of the art of available techniques;

    2. (b)

      develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.

  3. 3.

    The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.

  4. 4.

    The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.

  5. 5.

    The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).

Commission source wording and instructions

Article 41a

Commission proposal

Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).

Institutional text

Council Presidency texts

Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.

Article 29a

May Presidency compromise

Council wording reconstructed for this provision from the official operation

Article 29a - Application of pseudonymisation and identification of a natural person (1) Controllers and processors may apply pseudonymisation to personal data in order to reduce the risks to the data subjects concerned and to help meet their obligations under this Regulation.

Competing proposals

European Parliament amendments

These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.

More filters

Political group at the amendment date where available; otherwise the current Parliament affiliation.

Remove proposed wording Amendment 111 IMCO draft opinion · Alex Agius Saliba (rapporteur)
10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’
Justification

This is the competence of DPAs, not the Commission. Therefore it is not creating simplification, but rather bypassing MS authorities. The EDPB already adopted Guidelines 01/2025 on pseudonymisation. Imp: EDPB flags already that pseudonymisation is a risk-mitigation measure.

Preview
against:
Remove proposed wording Amendment 256 · Daniel Buda JURI
10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purposes of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’
Justification

Pseudonymisation is not, in and of itself, equivalent to anonymisation. A solution involving implementing acts would take a matter of principle – the scope of the GDPR’s application – out of the realm of the co-legislator and judicial interpretation and turn it into a technical procedure.

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 (GDPR) / Article 41 a

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 257 · Arash Saeidi JURI
10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’
Source identification

The literal header reads Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 3 – paragraph 1 – point 10 – introductory part. Its amended-law locator is inconsistent with the base column, but the proposal operation and matching base text support Regulation (EU) 2016/679 Article 41a. The literal header remains visible and the target is labelled as an inference.

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 3 – paragraph 1 – point 10 – introductory part

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 394 · David Cormand on behalf of the Verts/ALE Group IMCO
10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’
Preview
against:
Source identification

The literal header reads Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / new. Its placeholder or broad scope label is preserved rather than treated as a provision; the proposal parent and supplied base independently support Regulation (EU) 2016/679 Article 41a.

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / new

Deletion marker printed in the source: deleted

Alternative wording Amendment 395 · Virginie Joron IMCO
(1) The Commission mayshall be authorised to adopt implementingguidelines actsspecifying to specify meanstechnical and criteriaorganisational measures, including consent management mechanisms, privacy-preserving technologies and privacy-strengthening methods, which may be taken into account to determine whether a processor, a subcontractor, a data resultingholder fromor pseudonymisationa nodata longerrecipient constituteshas means which are reasonably likely to be used to identify a natural person and to fulfil the obligations relating to a request for consent. These guidelines shall be adopted in close cooperation with the European Data Protection Board and shall be aimed at improving legal certainty, interoperability and the consistent application of this Regulation throughout the Union. The adoption of these guidelines shall be without prejudice to the interpretation of Union law by the Court of Justice of the European Union, including as regards the notions of personal data, foridentifiable certainnatural entitiesperson, pseudonymised data, anonymisation and means reasonably likely to be used.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 a – paragraph 1

Alternative wording Amendment 396 · Piotr Müller IMCO
(a) assess the state of the art of available techniques, such as privacy enhancing technologies;
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2

Alternative wording Amendment 397 · Virginie Joron IMCO
(3) The implementation, by a processor, a subcontractor, a data holder or a data recipient, of thetechnical meansand organisational measures and criteria outlinedset out in anthe implementingguidelines actreferred to in paragraph [1] may be usedreferred to as an element which makes it possible to demonstrate that data cannotare leadnot, or are no longer, likely to allow the reidentification of the data subjects, and that the data subject has fulfilled his or her obligations, including those relating to the request for consent, under this Regulation. Consideration of these elements shall not affect the assessment of specific circumstances on a case-by-case basis by the competent supervisory authority or the interpretation of Union law by the Court of Justice of the European Union.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 a – paragraph 3

Alternative wording Amendment 398 · Piotr Müller IMCO
(3) The implementation ofWhere the means and criteria outlined in an implementing act mayare implemented, the data shall be usedpresumed as an elementnot to demonstrate that data cannot lead to the reidentification of the data subjects.
Justification

Turns advanced privacy-enhancing technologies into a rebuttable presumption of compliance, giving legal certainty and rewarding investment in privacy technology instead of paperwork.

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 3

Remove proposed wording Amendment 399 · Virginie Joron IMCO
(5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 a – paragraph 5

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1243 · Sibylle Berg, Martin Sonneborn ITRE · LIBE

The source names this article, but its precise target scope has not been resolved. Related tracker provisions are not asserted as direct targets.

Article 41a

10. The following article is inserted: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1244 · Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec ITRE · LIBE
10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 a (new)

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1245 · Irena Joveva, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller ITRE · LIBE
10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1246 · Pernando Barrena Arza ITRE · LIBE
10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1247 · Markéta Gregorová on behalf of the Verts/ALE Group ITRE · LIBE
10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1248 · João Oliveira ITRE · LIBE
10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 a

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1250 · Mary Khan ITRE · LIBE
Article 41a
Justification

The Commission could, by means of technical implementing acts, define entire categories of pseudonymised data as being outside the scope of the GDPR. Although pseudonymisation reduces risks, it does not eliminate the link to a person. A legal effect as fundamental as this must not be delegated to the Commission.

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a

Deletion marker printed in the source: deleted

Alternative wording Amendment 1251 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
(1) The Commission mayshall be empowered to adopt implementingguidelines specifying technical and organisational measures, including consent-management mechanisms, privacy-preserving technologies and privacy-enhancing techniques, that may be taken into account when assessing whether a controller, processor, data holder or data recipient has means reasonably likely to be used to identify a natural person and comply with its consent requesting obligations. Those guidelines shall be adopted in close cooperation with the European Data Protection Board and shall aim to promote legal certainty, interoperability and the consistent application of this Regulation across the Union. The adoption of those guidelines acts toshall specifybe meanswithout and criteriaprejudice to determinethe whetherinterpretation dataof resultingUnion fromlaw pseudonymisationby nothe longerCourt constitutesof Justice of the European Union, including as regards the concepts of personal data, foridentifiable certainnatural entitiesperson, pseudonymised data, anonymisation and means reasonably likely to be used.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – Paragraph 1

Alternative wording Amendment 1252 · Alice Teodorescu Måwe ITRE · LIBE
(1) The Commission may adopt implementing acts to specify means and criteria to determine whetherwhen data (a) is merely transitory in nature; (b) is unrelated to the data resultingsubject fromas pseudonymisationan noidentified longeror constitutesidentifiable personalnatural person; (c) has appropriate technical and/or organisational safeguards to prevent any use for a purpose related to the data forsubject certainas entitiesan identified or identifiable natural person.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1

Alternative wording Amendment 1253 · Michael McNamara, Christophe Grudler ITRE · LIBE
(1) The CommissionEuropean mayData adoptProtection implementingBoard acts(EDPB) shall issue an opinion in accordance with Article 64(2) addressing the application of pseudonymisation and anonymisation, including related technical and organisational measures, to specify the means and criteria to determine whether the application of pseudonymisation and anonymisation to personal data resultingeffectively fromprevents pseudonymisationthe identification of a data subject and the data subject is not or is no longer constitutes personal data for certain entitiesidentifiable.
Justification

Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1

Alternative wording Amendment 1254 · Oliver Schenk, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Andrea Wechsler, Marie-Sophie Lanig, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Axel Voss, François-Xavier Bellamy ITRE · LIBE
(1) The Commission may adopt implementing acts to specify meanstechnical and organisational measures and criteria tosupporting determinecontrollers in assessing whether data resulting from anonymisation or pseudonymisation no longer constitutes personal data for certain entities and in preventing the risk of re-identification.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1

Alternative wording Amendment 1255 · Ondřej Krutílek ITRE · LIBE
(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities because those entities are not reasonably likely to identify the natural person.
Justification

Generally, the comitology is strongly supported in relation to this issue. Rules of such significance should be adopted in a binding, formal and predictable way to ensure legal certainty for controllers. Soft law in form of EDPB opinion is not acceptable. This is primary concern as regards pseudonymisation; the other proposals just aim to improve on original text.

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1

Alternative wording Amendment 1256 · François-Xavier Bellamy ITRE · LIBE
(1) The Commission may adopt implementing acts to specify the technical means and any relevant criteria to determine whether data resulting from pseudonymisation constitutes anonymized data that no longer constitutes personal data for certaina entitiesspecific entity. (Article 41 new of Regulation (EU) 2016/679)
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1

Alternative wording Amendment 1257 · Henrik Dahl ITRE · LIBE
(1) The Commission may adopt implementing acts to specify means and criteria to determine whetherwhen data resulting from pseudonymisation no longer constitutes personal data for certain entities.:
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1

Alternative wording Amendment 1258 · Axel Voss ITRE · LIBE
(1) The Commission may adopt implementing acts toproviding specifyspecifications, meanscriteria, methodologies and criteriapractical requirements necessary to determineensure whetherthe datauniform resultingapplication fromof pseudonymisationthis noRegulation longerthroughout constitutesthe personal data for certain entitiesUnion.
Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

Source identification

The literal header reads Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 – paragraph 1. Its amended-law locator is inconsistent with the base column, but the proposal operation and matching base text support Regulation (EU) 2016/679 Article 41a(1). The literal header remains visible and the target is labelled as an inference.

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 – paragraph 1

Alternative wording Amendment 1259 · Tomas Tobé, Arba Kokalari, Jörgen Warborn ITRE · LIBE
(1) The Commission may adopt implementing acts to specify means and criteria to determine whetherwhen data resulting from pseudonymisation no longer constitutes personal data for certain entities.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1

Additional proposed wording Amendment 1260 · Henrik Dahl ITRE · LIBE

(1a) In Article 41a, paragraph 1, the following subparagraphs a, b, c are added

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1 – subparagraphs a, b, c (new)

Additional proposed wording Amendment 1261 · Michael McNamara, Christophe Grudler ITRE · LIBE

(1a) In Article 41a, the following paragraph 5a is inserted:

The Commission shall encourage and facilitate the drawing up of a code of conduct on the application of pseudonymisation and anonymisation, at Union level in accordance with the procedure planned in Article 40(7), in order to contribute to the proper application of this Regulation.'

Justification

Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 5a (new)

Additional proposed wording Amendment 1262 · Michael McNamara, Christophe Grudler ITRE · LIBE

(1b) In Article 41a, the following paragraph 5b is added:

When preparing a code of conduct on the application of pseudonymisation and anonymisation, in accordance with Article 40(2)(d), due account shall be taken of the European Data Protection Board (EDPB) opinion, as referred to in paragraph 1.'

Justification

Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 5b (new)

Additional proposed wording Amendment 1263 · Michael McNamara ITRE · LIBE

(1c)

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 3

Remove proposed wording Amendment 1264 · Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler ITRE · LIBE
(2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2

Deletion marker printed in the source: deleted

Alternative wording Amendment 1265 · Axel Voss ITRE · LIBE
(2) 2. ForImplementing theacts purposeadopted ofunder paragraph 1 themay Commissionin shallparticular:
Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

Source identification

The literal header reads Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 – paragraph 2. Its amended-law locator is inconsistent with the base column, but the proposal operation and matching base text support Regulation (EU) 2016/679 Article 41a(2). The literal header remains visible and the target is labelled as an inference.

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 – paragraph 2

Remove proposed wording Amendment 1266 · Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler ITRE · LIBE
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point a

Deletion marker printed in the source: deleted

Alternative wording Amendment 1267 · Axel Voss ITRE · LIBE
(a) assessspecify thecriteria stateand ofmethodologies thefor artassessing ofwhether availabledata techniquesresulting from anonymisation or pseudonymisation can reasonably be used to identify or re-identify a natural person;
Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point a

Alternative wording Amendment 1268 · Tomas Tobé, Arba Kokalari, Jörgen Warborn ITRE · LIBE
(a) assess the state of the art of available techniques , including Privacy Enhancing Technologies (PET);
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point a

Alternative wording Amendment 1269 · Oliver Schenk, Eva Maydell, Andrea Wechsler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Angelika Niebler, Axel Voss, Marie-Sophie Lanig, Ana Miguel Pedro, Romana Tomc, Marion Walsmann, Lena Düpont, François-Xavier Bellamy ITRE · LIBE
(a) assess the state of the art of available techniques, such as privacy-enhancing technologies;
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point a

Alternative wording Amendment 1270 · Krzysztof Hetman, Adam Jarubas ITRE · LIBE
(a) assess the state of the art of available techniques such as privacy enhancing technologies;;
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point a

Alternative wording Amendment 1271 · François-Xavier Bellamy ITRE · LIBE
(a) assess the state of the art of available techniquestechnical means;
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point a

Remove proposed wording Amendment 1272 · Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler ITRE · LIBE
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b

Deletion marker printed in the source: deleted

Alternative wording Amendment 1273 · François-Xavier Bellamy ITRE · LIBE
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in practice in relation to typical recipients of data. The criteria should take into account, inter alia, the likelihood of identifying a natural person, the possibility of linking records relating to a natural person, and the potential of inferring information concerning a natural person.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b

Alternative wording Amendment 1274 · Ondřej Krutílek ITRE · LIBE
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical or reasonably foreseeable recipients of data, based on costs, amount of time required, available technology, legal powers and restrictions and all other relevant objective factors.
Justification

The implementing acts should not directly determine the notion of personal data, they should include the core requirements on the means and criteria. It should be done by introducing the reason for why the data lose the status of personal data in relation to specific entities in para (1) and by adapting point 2(b) to cover the basic factors contributing to risk of re-identification (according to recital 26 GDPR). “or reasonably foreseeable” is added to address risk-based determination of other than typical or intended recipients.

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b

Alternative wording Amendment 1275 · Oliver Schenk, Eva Maydell, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Andrea Wechsler, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig, François-Xavier Bellamy ITRE · LIBE
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data, taking into account objective factors such as cost, amount of time required, available technology, legal obligations.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b

Alternative wording Amendment 1276 · Alice Teodorescu Måwe ITRE · LIBE
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identificationdata inbeing relationused for a purpose related to typical recipients ofthe data. subject as an identified or identifiable natural person
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b

Alternative wording Amendment 1277 · Katri Kulmuni ITRE · LIBE
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identificationdata inbeing relationused for a purpose related to typical recipients ofthe data subject as an identified or identifiable natural person.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b

Alternative wording Amendment 1278 · Henrik Dahl ITRE · LIBE
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identificationdata inbeing relationused for a purpose related to typical recipients ofthe data subject as an identified or identifiable natural person.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b

Alternative wording Amendment 1279 · Tomas Tobé, Arba Kokalari, Jörgen Warborn ITRE · LIBE
(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identificationdata inbeing relationused for a purpose related to typical recipients ofthe data. subject as an identifiable natural person
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b

Alternative wording Amendment 1280 · Axel Voss ITRE · LIBE
(b) developspecify criteriamethodologies for assessing risks to the rights and or categories for controllers and recipients to assess the riskfreedoms of re-identificationnatural in relation to typical recipients of data.persons;
Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b

Additional proposed wording Amendment 1281 · Oliver Schenk, Eva Maydell, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Axel Voss, Marie-Sophie Lanig, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, François-Xavier Bellamy ITRE · LIBE

(ba) In Article 41a, paragraph 2, the following point ba is added

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point ba (new)

Additional proposed wording Amendment 1282 · Axel Voss ITRE · LIBE

(ba) In Article 41a, paragraph 2, the following point ba is added

Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point ba (new)

Additional proposed wording Amendment 1283 · Axel Voss ITRE · LIBE

(bb) In Article 41a, paragraph 2, the following point ba is added

Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point bb (new)

Additional proposed wording Amendment 1284 · Axel Voss ITRE · LIBE

(bc) In Article 41a, paragraph 2, the following point ba is added

Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point bc (new)

Additional proposed wording Amendment 1285 · Axel Voss ITRE · LIBE

(bd) In Article 41a, paragraph 2, the following point ba is added

Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point bd (new)

Remove proposed wording Amendment 1286 · Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler ITRE · LIBE
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 3

Deletion marker printed in the source: deleted

Alternative wording Amendment 1287 · Francesco Torselli ITRE · LIBE
(3) TheIn implementationthe context of a group of undertakings, data resulting from pseudonymisation shall no longer constitute personal data for an undertaking where: (a) binding intra-group arrangements and appropriate technical and organisational measures, such as logical segregation and access controls, ensure that the undertaking does not have access, and is not reasonably likely to obtain access, to identification keys or additional identifying information held by another group undertaking prohibit any attempt at re-identification, and ensure that the undertaking does not possess other means reasonably likely to enable the re-identification of data subjects; and (b) criteriathe outlinedundertaking inis an implementing act may be used as an elementable to demonstrate thatthe data cannot lead to reidentificationeffectiveness of thesuch dataarrangements subjectsand measures.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 3

Alternative wording Amendment 1288 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
(3) The implementation by a controller, processor, data holder or data recipient of the meanstechnical and organisational measures and criteria outlinedset out in anthe implementingguidelines actreferred to in paragraph [1] may be usedrelied upon as an element to demonstrate that the data cannotare not, or are no longer, likely to lead to reidentificationthe re-identification of the data subjects, and that the person concerned has complied with its obligations, including its consent-requesting obligations, under this Regulation. Such reliance shall be without prejudice to the assessment of the specific circumstances of each case by the competent supervisory authority and to the interpretation of Union law by the Court of Justice of the European Union.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – Paragraph 3

Alternative wording Amendment 1289 · Oliver Schenk, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Axel Voss, Marie-Sophie Lanig, Ana Miguel Pedro, Marion Walsmann, Romana Tomc, Lena Düpont, Aura Salla, François-Xavier Bellamy ITRE · LIBE
(3) The implementation of the meanstechnical and organisational measures and criteria outlined in an implementing act may be used as an element to demonstrate that pseudonymised data cannotdo not lead to reidentification of the data subjects in a specific case.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 3

Alternative wording Amendment 1290 · Henrik Dahl ITRE · LIBE
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot leadbe used for any purpose related to reidentification of the data subjects as an identified or identifiable natural person.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 3

Alternative wording Amendment 1291 · Alice Teodorescu Måwe ITRE · LIBE
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot leadbe used for any purpose related to reidentification of the data subjects as an identified or identifiable natural person.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 3

Alternative wording Amendment 1292 · Tomas Tobé, Arba Kokalari, Jörgen Warborn ITRE · LIBE
(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot leadbe used for any purpose related to reidentification of the data subjects as an identifiable natural person.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1

Alternative wording Amendment 1293 · Axel Voss ITRE · LIBE
(3) TheCompliance implementationwith of the means andspecifications, criteria outlinedor methodologies set out in an implementing actacts adopted under this Article may be used by controllers and processors as an element to demonstrate thatcompliance datawith cannotthis lead to reidentification of the data subjectsRegulation.
Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 3

Remove proposed wording Amendment 1295 · Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler ITRE · LIBE
(4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 4

Deletion marker printed in the source: deleted

Alternative wording Amendment 1296 · Tomas Tobé, Arba Kokalari, Jörgen Warborn ITRE · LIBE
(4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion, which shall be made public, on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 4

Alternative wording Amendment 1297 · Axel Voss ITRE · LIBE
(4) The Commission shall closely involve the EDPBEuropean Data Protection Board in the preparationspreparation of the implementing acts under this Article. The EPDBEuropean Data Protection Board shall issue an opinion on the draft implementing acts within a deadline of 8eight weeks as of the receipt of the draft fromimplementing the Commissionact.
Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

Source identification

The literal header reads Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 – paragraph 4. Its amended-law locator is inconsistent with the base column, but the proposal operation and matching base text support Regulation (EU) 2016/679 Article 41a(4). The literal header remains visible and the target is labelled as an inference.

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 – paragraph 4

Remove proposed wording Amendment 1298 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE
(5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – Paragraph 5

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1299 · Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler ITRE · LIBE
(5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).
Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 5

Deletion marker printed in the source: deleted

Alternative wording Amendment 1300 · Axel Voss ITRE · LIBE
(5) The Implementingimplementing Actsacts referred to in this Article shall be adopted in accordance with the examination procedure referred to in Article 93(3).
Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

Preview
against:
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 5