Regulation (EU) 2016/679 — Article 5

Article total: 7 parts · 4 Council drafts · 19 Parliament amendments

Tracked part

Removed wording is struck through; added or replacement wording is highlighted.

Institutional text

European Commission proposal

All Commission’s changes to GDPR

The wording proposed by the Commission at the start of this legislative file.

Full article with Commission changes

Article with proposed changes

Official consolidated text dated 4 May 2016, with the Commission proposal change affecting this article applied.

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), ~~not~~ be considered to be ~~incompatible~~compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Commission source wording and instructions

Article 5(1)(b)

Commission proposal

Institutional text

Council Presidency texts

Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.

Council document

View full Council comparison →

Article in May Presidency compromise Council text

Comparison basis: Existing law (4 May 2016) compared with May Presidency compromise (21 May 2026)

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the application of appropriate safeguards in accordance with Article 89(1), ~~not~~ be considered to be ~~incompatible~~compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Article 5(1)(b)

May Presidency compromise

View full Council comparison →

Article in June Presidency compromise · 10 June Council text

Comparison basis: Existing law (4 May 2016) compared with June Presidency compromise · 10 June (10 June 2026)

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the application of appropriate safeguards in accordance with Article 89(1), ~~not~~ be considered to be ~~incompatible~~compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Article 5(1)(b)

June Presidency compromise · 10 June

View full Council comparison →

Article in June Presidency compromise · 18 June Council text

Comparison basis: Existing law (4 May 2016) compared with June Presidency compromise · 18 June (18 June 2026)

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the application of appropriate safeguards in accordance with Article 89(1), ~~not~~ be considered to be ~~incompatible~~compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Article 5(1)(b)

June Presidency compromise · 18 June

View full Council comparison →

Article in September Presidency compromise Council text

Comparison basis: Existing law (4 May 2016) compared with September Presidency compromise (3 September 2026)

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the application of appropriate safeguards in accordance with Article 89(1), ~~not~~ be considered to be ~~incompatible~~compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulations (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Article 5(1)(b)

September Presidency compromise

Council wording reconstructed for this provision from the official operation

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the application of appropriate safeguards in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulations (‘purpose limitation’)

Official source passage and amending instruction

2. Article 5(1)(b) is replaced by the following: ‘(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the application of appropriate safeguards in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulations (‘purpose limitation’);’

Article 5(1)(b) 4 Council drafts

Article 5(1)(b)

21 May 2026 · May Presidency compromise

Article 5(1)(b)

10 June 2026 · June Presidency compromise · 10 June

Article 5(1)(b)

18 June 2026 · June Presidency compromise · 18 June

Article 5(1)(b)

3 September 2026 · September Presidency compromise

Council wording reconstructed for this provision from the official operation

Official source passage and amending instruction

Competing proposals

European Parliament amendments

These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.

Search amendments

Political group at the amendment date where available; otherwise the current Parliament affiliation.

Alternative wording Amendment 45 ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the application of appropriate safeguards in accordance with Article 89(1), ~~not~~ be considered to be ~~incompatible~~compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the application of appropriate safeguards in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Additional proposed wording Amendment 238 JURI

2a. After Article 5(3), the following subparagraph is added

This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes the processing of personal data.

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).
3.

This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes the processing of personal data.

Alternative wording Amendment 359 IMCO

‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes~~, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’)~~;’

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  ‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes~~, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation~~;’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Additional proposed wording Amendment 360 IMCO

2a. The following subparagraph is added after Article 5(3)

This paragraph shall not apply if the subscriber or user is a natural person and the information stored or accessed constitutes the processing of personal data.

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).
3.

This paragraph shall not apply if the subscriber or user is a natural person and the information stored or accessed constitutes the processing of personal data.

Remove proposed wording Amendment 990 ITRE · LIBE

2. Article 5 (1)(b) is replaced by the following: ‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);’

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be ~~compatible~~incompatible with the initial purposes~~, independent of the conditions of Article 6(4) of this Regulation,~~ (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Alternative wording Amendment 991 ITRE · LIBE

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or for the development, training, testing, validation or use of new technical solutions based on aggregated data, including AI systems and AI models, subject to the safeguards in Article 88c and without prejudice to Article 9 shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);

Justification

Data collected for one purpose can be reused for research, statistics, archiving, or for training, testing, or using AI systems on data from which individuals are not identifiable, and this reuse is deemed compatible with the original purpose (so no separate legal basis is needed under Art. 6(4)), provided the Article 88c safeguards apply and it doesn't override Article 9 (special category data protections).

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or for the development, training, testing, validation or use of new technical solutions based on aggregated data, including AI systems and AI models, subject to the safeguards in Article 88c and without prejudice to Article 9 shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Alternative wording Amendment 992 ITRE · LIBE

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, ~~in accordance with Article 89(1),~~only be considered to be compatible with the initial purposes, ~~independent of~~when the ~~conditions~~requirements of Article 6(4) and guarantees of ~~this~~Article ~~Regulation~~89(1) have been met. General product development as well as the training, testing or validation of general AI systems or AI models shall not be considered compatible purposes solely on the basis of their designation as research (‘purpose limitation’);’

Justification

Purpose limitation is a core principle of informational self-determination. A research label shall not replace testing.

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, ~~in accordance with Article 89(1),~~only be considered to be compatible with the initial purposes, ~~independent of~~when the ~~conditions~~requirements of Article 6(4) and guarantees of ~~this~~Article ~~Regulation~~89(1) have been met. General product development as well as the training, testing or validation of general AI systems or AI models shall not be considered compatible purposes solely on the basis of their designation as research (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Alternative wording Amendment 993 ITRE · LIBE

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the application of appropriate safeguards in accordance with Article 89(1) and the principle of lawfulness, be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the application of appropriate safeguards in accordance with Article 89(1) and the principle of lawfulness, be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Alternative wording Amendment 994 ITRE · LIBE

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes~~, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’)~~;
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Alternative wording Amendment 995 ITRE · LIBE

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, ~~independent of the conditions of Article 6(4) of this Regulation,~~ (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Alternative wording Amendment 996 ITRE · LIBE

Justification

Reinstatement of the currently valid text of the Regulation.

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be ~~compatible~~incompatible with the initial purposes~~, independent of the conditions of Article 6(4) of this Regulation,~~ (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Alternative wording Amendment 997 ITRE · LIBE

‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the implementation of appropriate safeguards in accordance with Article 89(1), be considered to be compatible with the initial purposes~~, independent of the conditions of Article 6(4)~~ of this Regulation, (‘purpose limitation’);’

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  ‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the implementation of appropriate safeguards in accordance with Article 89(1), be considered to be compatible with the initial purposes~~, independent of the conditions of Article 6(4)~~ of this Regulation, (‘purpose limitation’);’
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Additional proposed wording Amendment 1000 ITRE · LIBE

2a. In Article 5, the following paragraph 2a is inserted:

Where a controller collects personal data from a third party, or purchases, aggregates, enriches, sells or otherwise makes personal data available to third parties for commercial purposes, it shall, as part of the measures referred to in Article 24, verify and document the lawful origin of the data, the legal basis for their initial collection and for any subsequent processing, the purposes for which they were collected, the categories of data and of data subjects concerned, the information provided pursuant to Articles 13 and 14 and, where applicable, the validity of the consent obtained.

The controller shall not rely solely on a general declaration of compliance or on standard contractual terms supplied by the data provider. Verification shall be strengthened where the circumstances of the processing give rise to reasonable doubt as to the lawfulness of the collection or of the making available of the data, in particular where the data originate from an undisclosed or indeterminate source, where they concern a large number of data subjects, or where they have been obtained through successive transfers.

Where the controller is unable to demonstrate that lawfulness, it shall refrain from processing or from continuing to process the data concerned, and from selling them or making them available to third parties.'

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).
2a.

Where a controller collects personal data from a third party, or purchases, aggregates, enriches, sells or otherwise makes personal data available to third parties for commercial purposes, it shall, as part of the measures referred to in Article 24, verify and document the lawful origin of the data, the legal basis for their initial collection and for any subsequent processing, the purposes for which they were collected, the categories of data and of data subjects concerned, the information provided pursuant to Articles 13 and 14 and, where applicable, the validity of the consent obtained.
The controller shall not rely solely on a general declaration of compliance or on standard contractual terms supplied by the data provider. Verification shall be strengthened where the circumstances of the processing give rise to reasonable doubt as to the lawfulness of the collection or of the making available of the data, in particular where the data originate from an undisclosed or indeterminate source, where they concern a large number of data subjects, or where they have been obtained through successive transfers.
Where the controller is unable to demonstrate that lawfulness, it shall refrain from processing or from continuing to process the data concerned, and from selling them or making them available to third parties.'

Additional proposed wording Amendment 1001 ITRE · LIBE

2a. In Article 5, the following paragraph is added:

The principles of this Regulation relating to the protection of personal data shall be interpreted in such a way that the requirements of this Regulation are proportionate to the purpose for which they are intended and, in particular, take into account the varying likelihood and severity of the risk that data processing poses to the rights and freedoms of natural persons (risk-based approach). Measures taken to protect personal data must strike a fair balance with the interests or fundamental rights and freedoms of persons other than the data subject."

Justification

INNOVATION PACKAGE #1: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).
2a.

The principles of this Regulation relating to the protection of personal data shall be interpreted in such a way that the requirements of this Regulation are proportionate to the purpose for which they are intended and, in particular, take into account the varying likelihood and severity of the risk that data processing poses to the rights and freedoms of natural persons (risk-based approach). Measures taken to protect personal data must strike a fair balance with the interests or fundamental rights and freedoms of persons other than the data subject."

Additional proposed wording Amendment 1003 ITRE · LIBE

In Article 5, the following paragraph 3 is added

The principles and obligations laid down in this Regulation shall be applied and interpreted in a manner that is commensurate with the objective pursued by the provision concerned, that restricts the free movement of personal data no further than is necessary, and that gives due weight to the interests and to the fundamental rights and freedoms of persons other than the data subject.'

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Additional proposed wording Amendment 1006 ITRE · LIBE

2a. Article 5, paragraph 2 is amended as follows

The controller shall be responsible for, and demonstrate compliance with, paragraph 1 (‘accountability’).

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and ~~be able to~~ demonstrate compliance with, paragraph 1 (‘accountability’).

Alternative wording Amendment 1009 ITRE · LIBE

2b. In Article 5, paragraph 2 is amended:

2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). When assessing compliance with the accountability obligation, appropriate governance structures, in particular, the appointment of a data protection officer in accordance with Article 37, shall be taken into account."

Justification

DPO Package #1: The amendment strengthens accountability by recognising DPOs as practical governance safeguards and first points of contact for complaints. DPOs already advise controllers and processors, monitor compliance and support data subjects; giving them an explicit complaint-handling role makes resolution faster, less bureaucratic and closer to the facts. Voluntary or shared DPOs are encouraged. Supervisory authorities remain available where the complaint is not addressed or not fully remedied within one month.

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). When assessing compliance with the accountability obligation, appropriate governance structures, in particular, the appointment of a data protection officer in accordance with Article 37, shall be taken into account."

Additional proposed wording Amendment 1010 ITRE · LIBE

2b. After Article 5, paragraph 3, the following subparagraph is added

This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes the processing of personal data.

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);
3. (c)
  
  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).
3.

This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes the processing of personal data.

Alternative wording Amendment 1014 ITRE · LIBE

2d. Article 5, paragraph 1, point c is deleted:

1. Personal data shall be:"

Preview
against:

Article 5

Principles relating to processing of personal data

1.
Personal data shall be:
1. (a)
  
  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. (b)
  
  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);
3. (c)
  ~~adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);~~
  1. 1.
    
    Personal data shall be:"
4. (d)
  
  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
5. (e)
  
  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
6. (f)
  
  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2.

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Article in May Presidency compromise Council text

Article in June Presidency compromise · 10 June Council text

Article in June Presidency compromise · 18 June Council text

Article in September Presidency compromise Council text

Changes in context

European Commission proposal

Council Presidency text · ST 9547/26

Changes in context

Council Presidency text · ST 9547/26

Council Presidency text · ST 10426/26

Changes in context

Council Presidency text · ST 10426/26

Council Presidency text · ST 10677/26

Changes in context

Council Presidency text · ST 10677/26

Council Presidency text · ST 12535/26

Changes in context

Wording reproduced in the amendment

Amendment 990 · ITRE–LIBE amendments 777–1052 to the draft report: removal

Changes in context

Wording reproduced in the amendment

Amendment 991 · ITRE–LIBE amendments 777–1052 to the draft report

Changes in context

Wording reproduced in the amendment

Amendment 992 · ITRE–LIBE amendments 777–1052 to the draft report

Changes in context

Wording reproduced in the amendment

Amendment 993 · ITRE–LIBE amendments 777–1052 to the draft report

Changes in context

Wording reproduced in the amendment

Amendment 994 · ITRE–LIBE amendments 777–1052 to the draft report

Changes in context

Wording reproduced in the amendment

Amendment 995 · ITRE–LIBE amendments 777–1052 to the draft report

Changes in context

Wording reproduced in the amendment

Amendment 996 · ITRE–LIBE amendments 777–1052 to the draft report

Changes in context

Wording reproduced in the amendment

Amendment 997 · ITRE–LIBE amendments 777–1052 to the draft report

Changes in context

Wording reproduced in the amendment

Amendment 45 · ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)

Changes in context

Wording reproduced in the amendment

Amendment 359 · IMCO amendments 329–532 to the draft opinion

Changes in context

Wording reproduced in the amendment

Amendment 1014 · ITRE–LIBE amendments 777–1052 to the draft report

Changes in context

Wording reproduced in the amendment

Amendment 1009 · ITRE–LIBE amendments 777–1052 to the draft report