EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

GDPR· Article 25a

Analysis in our dossiers
Where the file stands·The definition of “personal data”·Binding criteria and accountable enforcement

Text

Article 25a GDPR as printed in the Council text of 22 October 2026

Application of pseudonymisation and identification of a natural person

Source Council, 22 October 2026. Article 25a: ST 14756/26, page 140 · pp. 140–141 · exact text page

(1)

Controllers and processors may apply pseudonymisation in order to reduce the risks to the data subjects concerned and to comply with their obligations under this Regulation, in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information. The application of pseudonymisation shall be subject to appropriate technical and organisational measures, including security measures, to prevent other persons from identifying the data subject.

(2)

Pseudonymised data shall not be considered personal data for third party if that third party is unable to identify the natural person to whom the data relates.

(3)

Where a third party discloses, transmits or otherwise makes data referred to in paragraph 2 available to another third party and, in light of all relevant circumstances, that other third party possesses or can obtain means reasonably likely to enable the data subject to be identified, both the transmission of the data to that other third party and the subsequent processing of the data by that other third party is processing of personal data.

(4)

Where a processor processes personal data on behalf of a controller, that data shall be considered personal data for the processor, and the processor continues to be subject to the obligations applicable under this Regulation.

(5)

To determine whether a natural person is identifiable, including through personal data having undergone pseudonymisation, account shall be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly.

(6)

The Board shall issue an opinion, in accordance with Article 64(2) of this Regulation, addressing the application of pseudonymisation and anonymisation, including related technical and organisational measures.

(7)

The Chair of the Board shall request the opinion referred to in paragraph 4 no later than 6 months after the entry into force of this Regulation. The opinion shall be reviewed and updated where necessary.

Cross-referenceParagraph 7 cites ‘the opinion referred to in paragraph 4’. Paragraph 4 mentions no opinion. Paragraph 6 provides for it.

Article 25a in the whole GDPR

How the provision changed

Show the statuses

Each text against the law in forceEach text against the text before it

What each text would do to the law in force
Element Commission19 Nov 2025Art 41a Council21 May 2026Art 29a Council10 Jun 2026Art 29a Council18 Jun 2026Art 29a Council3 Sep 2026Art 25a Council2 Oct 2026Art 25a Council22 Oct 2026Art 25a
Compared withlaw in forcethe proposal21 May text10 Jun text18 Jun text3 Sep text2 Oct text
From the Commission’s Article 41a
Criteria for when pseudonymised data stop being personal
41a(1)–(2) Adds Added
29a(2) Adds, replaced since the proposal Replaced An EDPB opinion replaces Commission implementing acts.
29a(4) Adds, changed since 21 May Changed
29a(4) Adds, changed since 10 Jun Changed
25a(6) Adds, changed since 18 Jun Changed
25a(6) Adds Unchanged
25a(6) Adds Unchanged
Following the criteria as evidence
41a(3) Adds Added
Not in the law in force or this text, dropped since the proposal Dropped
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
EDPB role in preparing the Commission’s acts
41a(4) Adds Added
Not in the law in force or this text, dropped since the proposal Dropped
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Adoption procedure
41a(5) Adds Added
Not in the law in force or this text, dropped since the proposal Dropped
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Added in the Council texts
Permission to pseudonymise
Not in the law in force or this text In neither text
29a(1) Adds, added since the proposal Added
29a(1), first sentence Adds, changed since 21 May Changed
29a(1), first sentence Adds Unchanged
25a(1) Adds Unchanged
25a(1), first sentence Adds Unchanged
25a(1), first sentence Adds Unchanged
Identifiability test
see Art 4(1)
29a(1a) Adds, added since the proposal Added
29a(1), second sentence Adds, changed since 21 May Changed
29a(1), second sentence Adds Unchanged
25a(3) Adds, changed since 18 Jun Changed
25a(5) Adds, changed since 3 Sep Changed
25a(5) Adds Unchanged
Pseudonymised data in the hands of others
see Art 4(1)
Not in the law in force or this text In neither text
29a(2) Adds, added since 21 May Added
29a(2) Adds Unchanged
25a(2) Adds, changed since 18 Jun Changed
25a(2) Adds, changed since 3 Sep Changed
25a(2) Adds Unchanged
Without-prejudice clause
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
29a(3) Adds, added since 21 May Added
29a(3), first sentence Adds, changed since 10 Jun Changed
Not in the law in force or this text, dropped since 18 Jun Dropped
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Processors
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
29a(3), second sentence Adds, added since 10 Jun Added
25a(4) Adds, changed since 18 Jun Changed
25a(4) Adds, changed since 3 Sep Changed
25a(4) Adds Unchanged
Onward disclosure to someone able to identify
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
25a(5) Adds, added since 18 Jun Added
25a(3) Adds, changed since 3 Sep Changed
25a(3) Adds Unchanged
Deadline to request the EDPB opinion
Not in the law in force or this text In neither text
29a(3) Adds, added since the proposal Added Refers to the opinion “in paragraph 1”; in this text the opinion is in paragraph 2.
29a(5) Adds, changed since 21 May Changed
29a(5) Adds Unchanged
25a(7) Adds Unchanged Council did not update this cross-reference
25a(7) Adds Unchanged Refers to the opinion “in paragraph 4”; in this text the opinion is in paragraph 6.
25a(7) Adds Unchanged Refers to the opinion “in paragraph 4”; in this text the opinion is in paragraph 6.
Measures preventing identification
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
25a(1), second sentence Adds, added since 3 Sep Added
25a(1), second sentence Adds Unchanged

Each text against the law in force: +Adds adds a provision the law in force lacks— neither the law in force nor the text has it changed from the text before

Each text against the text before it: +Added in this text, not in the text before~Changed wording changed↺Replaced a different mechanism takes its place−Dropped drops a provision the text before added=Unchanged same as the text before— in neither text

Council text of 21 May 2026 · ST 9547/26 ST 9547/26 reproduces only some of the proposal’s changes, so this comparison applies only those it shows or visibly drops. It says nothing about the others.

Council text of 2 October 2026 · ST 13886/26 Page 126 prints “(9a)” without an instruction or target, so no change can be assigned to that marker.

Parliament amendments

66 amendments, all citing the Commission’s numbering

10 amendments would delete the whole article: members of The Left, S&D, Greens/EFA, Renew, EPP and non-attached members, and the IMCO rapporteur.

By political group; co-sponsored amendments count for each group
TypeThe LeftS&DGreens/EFARenewEPPECRPfEESNNIRapporteur
− Deletion3127112111
~ Alternative···22774···
+ Addition···36·····

By political group

  • − Deletion The Left 3 S&D 1 Greens/EFA 2 Renew 7 EPP 1 ECR 1 PfE 2 ESN 1 NI 1 Rapporteur 1
  • ~ Alternative Renew 2 EPP 27 ECR 7 PfE 4
  • + Addition Renew 3 EPP 6

Show

Article 41a as a whole10 amendments

  1. 111 Deletion Alex Agius Saliba (rapporteur)Rapporteur · IMCO Deletes the proposed article

    10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

    Justification

    This is the competence of DPAs, not the Commission. Therefore it is not creating simplification, but rather bypassing MS authorities. The EDPB already adopted Guidelines 01/2025 on pseudonymisation. Imp: EDPB flags already that pseudonymisation is a risk-mitigation measure.

    Rapporteur
    Alex Agius Saliba
    Group
    Rapporteur
    Targets
    GDPR Article 41a
    Document
    IMCO draft opinion
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a
  2. 256 Deletion Daniel BudaEPP · JURI Deletes the proposed article

    10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purposes of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

    Justification

    Pseudonymisation is not, in and of itself, equivalent to anonymisation. A solution involving implementing acts would take a matter of principle – the scope of the GDPR’s application – out of the realm of the co-legislator and judicial interpretation and turn it into a technical procedure.

    Tabled by
    Daniel Buda
    Group
    EPP
    Targets
    GDPR Article 41a
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 (GDPR) / Article 41 a
  3. 257 Deletion Arash SaeidiThe Left · JURI Deletes the proposed article

    10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

    Tabled by
    Arash Saeidi
    Group
    The Left
    Targets
    GDPR Article 41a
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 3 – paragraph 1 – point 10 – introductory part
  4. 394 Deletion David CormandGreens/EFA · IMCO Deletes the proposed article

    10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

    Tabled by
    David Cormand on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 41a
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / new
  5. 1243 Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the proposed article

    Tracker noteThe amendment names this article, but which paragraph or point it changes has not been automatically established, so it is not yet linked to a specific point.

    10. The following article is inserted: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    GDPR Article 41a
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a
  6. 1244 Deletion Marina Kaljurand +8S&D · ITRE–LIBE Deletes the proposed article

    10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

    Tabled by
    Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
    Group
    S&D
    Targets
    GDPR Article 41a
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 a (new)
  7. 1245 Deletion Irena Joveva +4Renew · ITRE–LIBE Deletes the proposed article

    10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

    Tabled by
    Irena Joveva, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 41a
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a
  8. 1246 Deletion Pernando Barrena ArzaThe Left · ITRE–LIBE Deletes the proposed article

    10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    GDPR Article 41a
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a
  9. 1247 Deletion Markéta GregorováGreens/EFA · ITRE–LIBE Deletes the proposed article

    10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 41a
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a
  10. 1248 Deletion João OliveiraThe Left · ITRE–LIBE Deletes the proposed article

    10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

    Tabled by
    João Oliveira
    Group
    The Left
    Targets
    GDPR Article 41a
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 a

Article heading1 amendment

  1. 1250 Deletion Mary KhanESN · ITRE–LIBE Deletes the Commission’s wording

    Article 41a

    Justification

    The Commission could, by means of technical implementing acts, define entire categories of pseudonymised data as being outside the scope of the GDPR. Although pseudonymisation reduces risks, it does not eliminate the link to a person. A legal effect as fundamental as this must not be delegated to the Commission.

    Tabled by
    Mary Khan
    Group
    ESN
    Targets
    GDPR Article 41a, heading
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a

Paragraph (1)Criteria for when pseudonymised data stop being personal10 amendments

  1. 395 Alternative Virginie JoronPfE · IMCO “has means which are reasonably likely to be used to identify a natural person and to fulfil the obligations relating to a request for consent. These…”

    (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.The Commission shall be authorised to adopt guidelines specifying technical and organisational measures, including consent management mechanisms, privacy-preserving technologies and privacy-strengthening methods, which may be taken into account to determine whether a processor, a subcontractor, a data holder or a data recipient has means which are reasonably likely to be used to identify a natural person and to fulfil the obligations relating to a request for consent. These guidelines shall be adopted in close cooperation with the European Data Protection Board and shall be aimed at improving legal certainty, interoperability and the consistent application of this Regulation throughout the Union. The adoption of these guidelines shall be without prejudice to the interpretation of Union law by the Court of Justice of the European Union, including as regards the notions of personal data, identifiable natural person, pseudonymised data, anonymisation and means reasonably likely to be used.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 41a(1)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 a – paragraph 1
  2. 1251 Alternative Julie Rechagneux +7ECR, PfE · ITRE–LIBE “guidelines specifying technical and organisational measures, including consent-management mechanisms, privacy-preserving technologies and…”

    (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.The Commission shall be empowered to adopt guidelines specifying technical and organisational measures, including consent-management mechanisms, privacy-preserving technologies and privacy-enhancing techniques, that may be taken into account when assessing whether a controller, processor, data holder or data recipient has means reasonably likely to be used to identify a natural person and comply with its consent requesting obligations. Those guidelines shall be adopted in close cooperation with the European Data Protection Board and shall aim to promote legal certainty, interoperability and the consistent application of this Regulation across the Union. The adoption of those guidelines acts shall be without prejudice to the interpretation of Union law by the Court of Justice of the European Union, including as regards the concepts of personal data, identifiable natural person, pseudonymised data, anonymisation and means reasonably likely to be used.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 41a(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – Paragraph 1
  3. 1252 Alternative Alice Teodorescu MåweEPP · ITRE–LIBE “natural person; (c) has appropriate technical and/or organisational safeguards to prevent any use for a purpose related to the”

    (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.The Commission may adopt implementing acts to specify means and criteria to determine when data (a) is merely transitory in nature; (b) is unrelated to the data subject as an identified or identifiable natural person; (c) has appropriate technical and/or organisational safeguards to prevent any use for a purpose related to the data subject as an identified or identifiable natural person.

    Tabled by
    Alice Teodorescu Måwe
    Group
    EPP
    Targets
    GDPR Article 41a(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1
  4. 1253 Alternative Michael McNamara +1Renew · ITRE–LIBE “(EDPB) shall issue an opinion in accordance with Article 64(2) addressing the application of pseudonymisation and anonymisation, including related…”

    (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.The European Data Protection Board (EDPB) shall issue an opinion in accordance with Article 64(2) addressing the application of pseudonymisation and anonymisation, including related technical and organisational measures, to specify the means and criteria to determine whether the application of pseudonymisation and anonymisation to personal data effectively prevents the identification of a data subject and the data subject is not or is no longer identifiable.

    Justification

    Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.

    Tabled by
    Michael McNamara, Christophe Grudler
    Group
    Renew
    Targets
    GDPR Article 41a(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1
  5. 1254 Alternative Oliver Schenk +12EPP · ITRE–LIBE “and in preventing the risk of re-identification”

    (1) The Commission may adopt implementing acts to specify meanstechnical and organisational measures and criteria tosupporting determinecontrollers in assessing whether data resulting from anonymisation or pseudonymisation no longer constitutes personal data for certain entities and in preventing the risk of re-identification.

    Tabled by
    Oliver Schenk, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Andrea Wechsler, Marie-Sophie Lanig, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Axel Voss, François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 41a(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1
  6. 1255 Alternative Ondřej KrutílekECR · ITRE–LIBE “because those entities are not reasonably likely to identify the natural person”

    (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities because those entities are not reasonably likely to identify the natural person.

    Justification

    Generally, the comitology is strongly supported in relation to this issue. Rules of such significance should be adopted in a binding, formal and predictable way to ensure legal certainty for controllers. Soft law in form of EDPB opinion is not acceptable. This is primary concern as regards pseudonymisation; the other proposals just aim to improve on original text.

    Tabled by
    Ondřej Krutílek
    Group
    ECR
    Targets
    GDPR Article 41a(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1
  7. 1256 Alternative François-Xavier BellamyEPP · ITRE–LIBE “(Article 41 new of Regulation (EU) 2016/679)”

    (1) The Commission may adopt implementing acts to specify the technical means and any relevant criteria to determine whether data resulting from pseudonymisation constitutes anonymized data that no longer constitutes personal data for certaina entitiesspecific entity. (Article 41 new of Regulation (EU) 2016/679)

    Tabled by
    François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 41a(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1
  8. 1257 Alternative Henrik DahlEPP · ITRE–LIBE “The Commission may adopt implementing acts to specify means and criteria to determine when data:”

    (1) The Commission may adopt implementing acts to specify means and criteria to determine whetherwhen data resulting from pseudonymisation no longer constitutes personal data for certain entities.:

    Tabled by
    Henrik Dahl
    Group
    EPP
    Targets
    GDPR Article 41a(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1
  9. 1258 Alternative Axel VossEPP · ITRE–LIBE “practical requirements necessary”

    (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.The Commission may adopt implementing acts providing specifications, criteria, methodologies and practical requirements necessary to ensure the uniform application of this Regulation throughout the Union.

    Justification

    The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 41a(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 – paragraph 1
  10. 1259 Alternative Tomas Tobé +2EPP · ITRE–LIBE “The Commission may adopt implementing acts to specify means and criteria to determine when data no longer constitutes personal data for certain…”

    (1) The Commission may adopt implementing acts to specify means and criteria to determine whetherwhen data resulting from pseudonymisation no longer constitutes personal data for certain entities.

    Tabled by
    Tomas Tobé, Arba Kokalari, Jörgen Warborn
    Group
    EPP
    Targets
    GDPR Article 41a(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1

New subparagraphs in paragraph 1Criteria for when pseudonymised data stop being personal1 amendment

  1. 1260 Addition Henrik DahlEPP · ITRE–LIBE “is merely transitory in nature; (b) is unrelated to the data subject as an identified or identifiable natural person; (c) has appropriate technical…”

    (1a) In Article 41a, paragraph 1, the following subparagraphs a, b, c are added

    (a)is merely transitory in nature;

    (b)is unrelated to the data subject as an identified or identifiable natural person;

    (c)has appropriate technical and/or organisational safeguards to prevent any use for a purpose related to the data subject as an identified or identifiable natural person.'

    Tabled by
    Henrik Dahl
    Group
    EPP
    Targets
    GDPR Article 41a – paragraph 1 – subparagraphs a, b, c (new)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1 – subparagraphs a, b, c (new)

Paragraph (2)Criteria for when pseudonymised data stop being personal2 amendments

  1. 1264 Deletion Michael McNamara +4Renew · ITRE–LIBE Deletes the Commission’s wording

    (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.

    Tabled by
    Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
    Group
    Renew
    Targets
    GDPR Article 41a(2)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2
  2. 1265 Alternative Axel VossEPP · ITRE–LIBE “2. Implementing acts adopted under paragraph 1 may in particular:”

    (2) For the purpose of paragraph 1 the Commission shall:2. Implementing acts adopted under paragraph 1 may in particular:

    Justification

    The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 41a(2)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 – paragraph 2

Paragraph (2)(a)Criteria for when pseudonymised data stop being personal7 amendments

  1. 396 Alternative Piotr MüllerECR · IMCO “such as privacy enhancing technologies”

    (a) assess the state of the art of available techniques, such as privacy enhancing technologies;

    Tabled by
    Piotr Müller
    Group
    ECR
    Targets
    GDPR Article 41a(2)(a)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2
  2. 1266 Deletion Michael McNamara +4Renew · ITRE–LIBE Deletes the Commission’s wording

    (a) assess the state of the art of available techniques;

    Tabled by
    Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
    Group
    Renew
    Targets
    GDPR Article 41a(2)(a)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point a
  3. 1267 Alternative Axel VossEPP · ITRE–LIBE “resulting from anonymisation or pseudonymisation can reasonably be used to identify or re-identify a natural person”

    (a) assess the state of the art of available techniques;specify criteria and methodologies for assessing whether data resulting from anonymisation or pseudonymisation can reasonably be used to identify or re-identify a natural person;

    Justification

    The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 41a(2)(a)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point a
  4. 1268 Alternative Tomas Tobé +2EPP · ITRE–LIBE “including Privacy Enhancing Technologies (PET)”

    (a) assess the state of the art of available techniques, including Privacy Enhancing Technologies (PET);

    Tabled by
    Tomas Tobé, Arba Kokalari, Jörgen Warborn
    Group
    EPP
    Targets
    GDPR Article 41a(2)(a)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point a
  5. 1269 Alternative Oliver Schenk +13EPP · ITRE–LIBE “such as privacy-enhancing technologies”

    (a) assess the state of the art of available techniques, such as privacy-enhancing technologies;

    Tabled by
    Oliver Schenk, Eva Maydell, Andrea Wechsler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Angelika Niebler, Axel Voss, Marie-Sophie Lanig, Ana Miguel Pedro, Romana Tomc, Marion Walsmann, Lena Düpont, François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 41a(2)(a)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point a
  6. 1270 Alternative Krzysztof Hetman +1EPP · ITRE–LIBE “such as privacy enhancing technologies”

    (a) assess the state of the art of available techniques such as privacy enhancing technologies;;

    Tabled by
    Krzysztof Hetman, Adam Jarubas
    Group
    EPP
    Targets
    GDPR Article 41a(2)(a)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point a
  7. 1271 Alternative François-Xavier BellamyEPP · ITRE–LIBE “assess the state of the art of available technical means;”

    (a) assess the state of the art of available techniquestechnical means;

    Tabled by
    François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 41a(2)(a)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point a

Paragraph (2)(b)Criteria for when pseudonymised data stop being personal9 amendments

  1. 1272 Deletion Michael McNamara +4Renew · ITRE–LIBE Deletes the Commission’s wording

    (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.

    Tabled by
    Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
    Group
    Renew
    Targets
    GDPR Article 41a(2)(b)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b
  2. 1273 Alternative François-Xavier BellamyEPP · ITRE–LIBE “The criteria should take into account, inter alia, the likelihood of identifying a natural person, the possibility of linking records relating to a…”

    (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in practice in relation to typical recipients of data. The criteria should take into account, inter alia, the likelihood of identifying a natural person, the possibility of linking records relating to a natural person, and the potential of inferring information concerning a natural person.

    Tabled by
    François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 41a(2)(b)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b
  3. 1274 Alternative Ondřej KrutílekECR · ITRE–LIBE “based on costs, amount of time required, available technology, legal powers and restrictions and all other relevant objective factors”

    (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical or reasonably foreseeable recipients of data, based on costs, amount of time required, available technology, legal powers and restrictions and all other relevant objective factors.

    Justification

    The implementing acts should not directly determine the notion of personal data, they should include the core requirements on the means and criteria. It should be done by introducing the reason for why the data lose the status of personal data in relation to specific entities in para (1) and by adapting point 2(b) to cover the basic factors contributing to risk of re-identification (according to recital 26 GDPR). ‘or reasonably foreseeable’ is added to address risk-based determination of other than typical or intended recipients.

    Tabled by
    Ondřej Krutílek
    Group
    ECR
    Targets
    GDPR Article 41a(2)(b)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b
  4. 1275 Alternative Oliver Schenk +13EPP · ITRE–LIBE “taking into account objective factors such as cost, amount of time required, available technology, legal obligations”

    (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data, taking into account objective factors such as cost, amount of time required, available technology, legal obligations.

    Tabled by
    Oliver Schenk, Eva Maydell, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Andrea Wechsler, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig, François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 41a(2)(b)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b
  5. 1276 Alternative Alice Teodorescu MåweEPP · ITRE–LIBE “subject as an identified or identifiable natural person”

    (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identificationdata inbeing relationused for a purpose related to typical recipients ofthe data. subject as an identified or identifiable natural person

    Tabled by
    Alice Teodorescu Måwe
    Group
    EPP
    Targets
    GDPR Article 41a(2)(b)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b
  6. 1277 Alternative Katri KulmuniRenew · ITRE–LIBE “subject as an identified or identifiable natural person”

    (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identificationdata inbeing relationused for a purpose related to typical recipients ofthe data subject as an identified or identifiable natural person.

    Tabled by
    Katri Kulmuni
    Group
    Renew
    Targets
    GDPR Article 41a(2)(b)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b
  7. 1278 Alternative Henrik DahlEPP · ITRE–LIBE “subject as an identified or identifiable natural person”

    (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identificationdata inbeing relationused for a purpose related to typical recipients ofthe data subject as an identified or identifiable natural person.

    Tabled by
    Henrik Dahl
    Group
    EPP
    Targets
    GDPR Article 41a(2)(b)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b
  8. 1279 Alternative Tomas Tobé +2EPP · ITRE–LIBE “subject as an identifiable natural person”

    (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identificationdata inbeing relationused for a purpose related to typical recipients ofthe data. subject as an identifiable natural person

    Tabled by
    Tomas Tobé, Arba Kokalari, Jörgen Warborn
    Group
    EPP
    Targets
    GDPR Article 41a(2)(b)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b
  9. 1280 Alternative Axel VossEPP · ITRE–LIBE “methodologies for assessing risks to the rights”

    (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.specify methodologies for assessing risks to the rights and freedoms of natural persons;

    Justification

    The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 41a(2)(b)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point b

New points in paragraph 2Criteria for when pseudonymised data stop being personal5 amendments

  1. 1281 Addition Oliver Schenk +13EPP · ITRE–LIBE “assess technical, administrative, organisational and contractual measures that can prevent the risk of re-identification.'”

    (ba) In Article 41a, paragraph 2, the following point ba is added

    (ba)assess technical, administrative, organisational and contractual measures that can prevent the risk of re-identification.'

    Tabled by
    Oliver Schenk, Eva Maydell, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Axel Voss, Marie-Sophie Lanig, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 41a – paragraph 2 – point ba (new)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point ba (new)
  2. 1282 Addition Axel VossEPP · ITRE–LIBE “establish or approve Union-wide Codes of Conduct pursuant to Article 40 where harmonised application is necessary;'”

    (ba) In Article 41a, paragraph 2, the following point ba is added

    (ba)establish or approve Union-wide Codes of Conduct pursuant to Article 40 where harmonised application is necessary;'

    Justification

    The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 41a – paragraph 2 – point ba (new)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point ba (new)
  3. 1283 Addition Axel VossEPP · ITRE–LIBE “establish or approve Certification mechanisms, seals and marks pursuant to Article 42, including certification criteria and conditions for…”

    (bb) In Article 41a, paragraph 2, the following point ba is added

    (bb)establish or approve Certification mechanisms, seals and marks pursuant to Article 42, including certification criteria and conditions for accreditation of certification bodies;'

    Justification

    The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 41a – paragraph 2 – point bb (new)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point bb (new)
  4. 1284 Addition Axel VossEPP · ITRE–LIBE “specify common technical and organisational measures that may be used to demonstrate compliance with this Regulation;'”

    (bc) In Article 41a, paragraph 2, the following point ba is added

    (bc)specify common technical and organisational measures that may be used to demonstrate compliance with this Regulation;'

    Justification

    The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 41a – paragraph 2 – point bc (new)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point bc (new)
  5. 1285 Addition Axel VossEPP · ITRE–LIBE “identify sector-specific circumstances, processing operations or use cases where harmonised interpretation is necessary to avoid fragmentation of the…”

    (bd) In Article 41a, paragraph 2, the following point ba is added

    (bd)identify sector-specific circumstances, processing operations or use cases where harmonised interpretation is necessary to avoid fragmentation of the internal market.'

    Justification

    The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 41a – paragraph 2 – point bd (new)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 2 – point bd (new)

Paragraph (3)Following the criteria as evidence12 amendments

  1. 397 Alternative Virginie JoronPfE · IMCO “Consideration of these elements shall not affect the assessment of specific circumstances on a case-by-case basis by the competent supervisory…”

    (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.The implementation, by a processor, a subcontractor, a data holder or a data recipient, of technical and organisational measures and criteria set out in the guidelines referred to in paragraph [1] may be referred to as an element which makes it possible to demonstrate that data are not, or are no longer, likely to allow the reidentification of the data subjects, and that the data subject has fulfilled his or her obligations, including those relating to the request for consent, under this Regulation. Consideration of these elements shall not affect the assessment of specific circumstances on a case-by-case basis by the competent supervisory authority or the interpretation of Union law by the Court of Justice of the European Union.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 41a(3)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 a – paragraph 3
  2. 398 Alternative Piotr MüllerECR · IMCO “are implemented, the data shall”

    (3) The implementation ofWhere the means and criteria outlined in an implementing act mayare implemented, the data shall be usedpresumed as an elementnot to demonstrate that data cannot lead to the reidentification of the data subjects.

    Justification

    Turns advanced privacy-enhancing technologies into a rebuttable presumption of compliance, giving legal certainty and rewarding investment in privacy technology instead of paperwork.

    Tabled by
    Piotr Müller
    Group
    ECR
    Targets
    GDPR Article 41a(3)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 3
  3. 1263 Addition Michael McNamaraRenew · ITRE–LIBE “3. When preparing a code of conduct on the application of pseudonymisation and anonymisation, in accordance with Article 40(2)(d), due account shall…”

    (1c)

    3.When preparing a code of conduct on the application of pseudonymisation and anonymisation, in accordance with Article 40(2)(d), due account shall be taken of the European Data Protection Board (EDPB) opinion, as referred to in paragraph 1.

    Tabled by
    Michael McNamara
    Group
    Renew
    Targets
    GDPR Article 41a(3)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 3
  4. 1286 Deletion Michael McNamara +4Renew · ITRE–LIBE Deletes the Commission’s wording

    (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.

    Tabled by
    Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
    Group
    Renew
    Targets
    GDPR Article 41a(3)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 3
  5. 1287 Alternative Francesco TorselliECR · ITRE–LIBE “a group of undertakings, data resulting from pseudonymisation shall no longer constitute personal data for an undertaking where: (a) binding…”

    (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.In the context of a group of undertakings, data resulting from pseudonymisation shall no longer constitute personal data for an undertaking where: (a) binding intra-group arrangements and appropriate technical and organisational measures, such as logical segregation and access controls, ensure that the undertaking does not have access, and is not reasonably likely to obtain access, to identification keys or additional identifying information held by another group undertaking prohibit any attempt at re-identification, and ensure that the undertaking does not possess other means reasonably likely to enable the re-identification of data subjects; and (b) the undertaking is able to demonstrate the effectiveness of such arrangements and measures.

    Tabled by
    Francesco Torselli
    Group
    ECR
    Targets
    GDPR Article 41a(3)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 3
  6. 1288 Alternative Julie Rechagneux +7ECR, PfE · ITRE–LIBE “Such reliance shall be without prejudice to the assessment of the specific circumstances of each case by the competent supervisory authority and to…”

    (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.The implementation by a controller, processor, data holder or data recipient of the technical and organisational measures and criteria set out in the guidelines referred to in paragraph [1] may be relied upon as an element to demonstrate that the data are not, or are no longer, likely to lead to the re-identification of the data subjects, and that the person concerned has complied with its obligations, including its consent-requesting obligations, under this Regulation. Such reliance shall be without prejudice to the assessment of the specific circumstances of each case by the competent supervisory authority and to the interpretation of Union law by the Court of Justice of the European Union.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 41a(3)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – Paragraph 3
  7. 1289 Alternative Oliver Schenk +13EPP · ITRE–LIBE “technical and organisational measures”

    (3) The implementation of the meanstechnical and organisational measures and criteria outlined in an implementing act may be used as an element to demonstrate that pseudonymised data cannotdo not lead to reidentification of the data subjects in a specific case.

    Tabled by
    Oliver Schenk, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Axel Voss, Marie-Sophie Lanig, Ana Miguel Pedro, Marion Walsmann, Romana Tomc, Lena Düpont, Aura Salla, François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 41a(3)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 3
  8. 1290 Alternative Henrik DahlEPP · ITRE–LIBE “as an identified or identifiable natural person”

    (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot leadbe used for any purpose related to reidentification of the data subjects as an identified or identifiable natural person.

    Tabled by
    Henrik Dahl
    Group
    EPP
    Targets
    GDPR Article 41a(3)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 3
  9. 1291 Alternative Alice Teodorescu MåweEPP · ITRE–LIBE “as an identified or identifiable natural person”

    (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot leadbe used for any purpose related to reidentification of the data subjects as an identified or identifiable natural person.

    Tabled by
    Alice Teodorescu Måwe
    Group
    EPP
    Targets
    GDPR Article 41a(3)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 3
  10. 1292 Alternative Tomas Tobé +2EPP · ITRE–LIBE “as an identifiable natural person”

    (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot leadbe used for any purpose related to reidentification of the data subjects as an identifiable natural person.

    Tabled by
    Tomas Tobé, Arba Kokalari, Jörgen Warborn
    Group
    EPP
    Targets
    GDPR Article 41a(3)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 1
  11. 1293 Alternative Axel VossEPP · ITRE–LIBE “acts adopted under this Article”

    (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.Compliance with specifications, criteria or methodologies set out in implementing acts adopted under this Article may be used by controllers and processors as an element to demonstrate compliance with this Regulation.

    Justification

    The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 41a(3)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 3
  12. 1294 Alternative François-Xavier BellamyEPP · ITRE–LIBE “The implementation of the means and criteria outlined in an implementing act may be used by an entity as an element to demonstrate that data cannot…”

    (3) The implementation of the means and criteria outlined in an implementing act may be used by an entity as an element to demonstrate that data cannot lead to reidentification of the data subjects by that entity.

    Tabled by
    François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 41a(3)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 new – paragraph 3

Paragraph (4)EDPB role in preparing the Commission’s acts3 amendments

  1. 1295 Deletion Michael McNamara +4Renew · ITRE–LIBE Deletes the Commission’s wording

    (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.

    Tabled by
    Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
    Group
    Renew
    Targets
    GDPR Article 41a(4)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 4
  2. 1296 Alternative Tomas Tobé +2EPP · ITRE–LIBE “which shall be made public”

    (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion, which shall be made public, on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.

    Tabled by
    Tomas Tobé, Arba Kokalari, Jörgen Warborn
    Group
    EPP
    Targets
    GDPR Article 41a(4)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 4
  3. 1297 Alternative Axel VossEPP · ITRE–LIBE “European Data Protection Board”

    (4) The Commission shall closely involve the EDPBEuropean Data Protection Board in the preparationspreparation of the implementing acts under this Article. The EPDBEuropean Data Protection Board shall issue an opinion on the draft implementing acts within a deadline of 8eight weeks as of the receipt of the draft fromimplementing the Commissionact.

    Justification

    The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 41a(4)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 – paragraph 4

Paragraph (5)Adoption procedure4 amendments

  1. 399 Deletion Virginie JoronPfE · IMCO Deletes the Commission’s wording

    (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 41a(5)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41 a – paragraph 5
  2. 1298 Deletion Julie Rechagneux +7ECR, PfE · ITRE–LIBE Deletes the Commission’s wording

    (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 41a(5)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – Paragraph 5
  3. 1299 Deletion Michael McNamara +4Renew · ITRE–LIBE Deletes the Commission’s wording

    (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).

    Tabled by
    Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Christophe Grudler
    Group
    Renew
    Targets
    GDPR Article 41a(5)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 5
  4. 1300 Alternative Axel VossEPP · ITRE–LIBE “acts referred to in this Article”

    (5) The Implementingimplementing Actsacts referred to in this Article shall be adopted in accordance with the examination procedure referred to in Article 93(3).

    Justification

    The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 41a(5)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 5

New paragraphs2 amendments

  1. 1261 Addition Michael McNamara +1Renew · ITRE–LIBE “The Commission shall encourage and facilitate the drawing up of a code of conduct on the application of pseudonymisation and anonymisation, at Union…” numbered 1a

    (1a) In Article 41a, the following paragraph 5a is inserted:

    The Commission shall encourage and facilitate the drawing up of a code of conduct on the application of pseudonymisation and anonymisation, at Union level in accordance with the procedure planned in Article 40(7), in order to contribute to the proper application of this Regulation.'

    Justification

    Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.

    Tabled by
    Michael McNamara, Christophe Grudler
    Group
    Renew
    Targets
    GDPR Article 41a – paragraph 5a (new)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 5a (new)
  2. 1262 Addition Michael McNamara +1Renew · ITRE–LIBE “When preparing a code of conduct on the application of pseudonymisation and anonymisation, in accordance with Article 40(2)(d), due account shall be…” numbered 1b

    (1b) In Article 41a, the following paragraph 5b is added:

    When preparing a code of conduct on the application of pseudonymisation and anonymisation, in accordance with Article 40(2)(d), due account shall be taken of the European Data Protection Board (EDPB) opinion, as referred to in paragraph 1.'

    Justification

    Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.

    Tabled by
    Michael McNamara, Christophe Grudler
    Group
    Renew
    Targets
    GDPR Article 41a – paragraph 5b (new)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 10 / Regulation (EU) 2016/679 / Article 41a – paragraph 5b (new)