Regulation (EU) 2016/679 — Article 6

Article total: 11 parts · 0 Council drafts · 11 Parliament amendments

Tracked part

Removed wording is struck through; added or replacement wording is highlighted.

Institutional text

European Commission proposal

The wording proposed by the Commission at the start of this legislative file.

No standalone Commission wording is mapped to these tracked parts. A newly proposed provision may have no earlier text of its own.

Institutional text

Council Presidency texts

Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.

No Council wording is mapped to these tracked parts.

Competing proposals

European Parliament amendments

These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.

Search amendments

Additional proposed wording Amendment 361 IMCO

2b. The following paragraph 1a is inserted in Article 6

1a.

For the purposes of paragraph 1, a data subject shall only be required to set up a permanent user account or supply personal data in order to access offers or purchase goods or services if it is strictly necessary to set up the account or supply the data.

If the offers can be accessed or the goods or services purchased without setting up a permanent user account or without supplying the data, the controller shall provide the data subject with a clear, easily accessible and non-discriminatory option for doing so, and use of this option shall not entail less favourable conditions for the data subject.’

Preview
against:

Article 6

Lawfulness of processing

1.
Processing shall be lawful only if and to the extent that at least one of the following applies:
1. (a)
  
  the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. (b)
  
  processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. (c)
  
  processing is necessary for compliance with a legal obligation to which the controller is subject;
4. (d)
  
  processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. (e)
  
  processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. (f)
  
  processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
1a.

For the purposes of paragraph 1, a data subject shall only be required to set up a permanent user account or supply personal data in order to access offers or purchase goods or services if it is strictly necessary to set up the account or supply the data.
If the offers can be accessed or the goods or services purchased without setting up a permanent user account or without supplying the data, the controller shall provide the data subject with a clear, easily accessible and non-discriminatory option for doing so, and use of this option shall not entail less favourable conditions for the data subject.’
2.

Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.
3.
The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:
1. (a)
  
  Union law; or
2. (b)
  
  Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.
4.
Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:
1. (a)
  
  any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;
2. (b)
  
  the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;
3. (c)
  
  the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;
4. (d)
  
  the possible consequences of the intended further processing for data subjects;
5. (e)
  
  the existence of appropriate safeguards, which may include encryption or pseudonymisation.

Additional proposed wording Amendment 998 ITRE · LIBE

i) In Article 6, paragraph 4, point d is replaced by the following

(d)

the possible consequences of the intended further processing for data subject, in particular where the data subject is a child;'

Preview
against:

Article 6

Lawfulness of processing

1.
Processing shall be lawful only if and to the extent that at least one of the following applies:
1. (a)
  
  the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. (b)
  
  processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. (c)
  
  processing is necessary for compliance with a legal obligation to which the controller is subject;
4. (d)
  
  processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. (e)
  
  processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. (f)
  
  processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
2.

Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.
3.
The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:
1. (a)
  
  Union law; or
2. (b)
  
  Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.
4.
Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:
1. (a)
  
  any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;
2. (b)
  
  the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;
3. (c)
  
  the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;
4. (d)
  
  the possible consequences of the intended further processing for data ~~subjects~~subject, in particular where the data subject is a child;'
5. (e)
  
  the existence of appropriate safeguards, which may include encryption or pseudonymisation.

Additional proposed wording Amendment 999 ITRE · LIBE

ii) In Article 6, paragraph 1, the following subparagraph is added

The processing of a child’s personal data for advertising purposes and for the creation of personality and user profiles is not permitted.

Preview
against:

Article 6

Lawfulness of processing

1.
Processing shall be lawful only if and to the extent that at least one of the following applies:
1. (a)
  
  the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. (b)
  
  processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. (c)
  
  processing is necessary for compliance with a legal obligation to which the controller is subject;
4. (d)
  
  processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. (e)
  
  processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. (f)
  
  processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
7. The processing of a child’s personal data for advertising purposes and for the creation of personality and user profiles is not permitted.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
2.

Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.
3.
The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:
1. (a)
  
  Union law; or
2. (b)
  
  Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.
4.
Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:
1. (a)
  
  any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;
2. (b)
  
  the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;
3. (c)
  
  the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;
4. (d)
  
  the possible consequences of the intended further processing for data subjects;
5. (e)
  
  the existence of appropriate safeguards, which may include encryption or pseudonymisation.

Additional proposed wording Amendment 1005 ITRE · LIBE

In Article 6, paragraph 1, point e, the following sentence is added

This is the case, when processing is necessary for the performance of a task carried out by a Member State related to national security (Article 4(2) TEU).

Context reproduced in the official amendment

The amendment reproduces a wider legal passage. It is shown as context because it does not cover the same legal unit as the proposed wording.

Article 6, paragraph 1(e)

Justification

It should be made possible for Member State authorities to make use of the necessary personal and non-personal (mixed) datasets if it is used for national security purposes. This amendment is however, not intended to narrow the existing exclusion or invite GDPR oversight of national security processing.

Preview
against:

Article 6

Lawfulness of processing

1.
Processing shall be lawful only if and to the extent that at least one of the following applies:
1. (a)
  
  the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. (b)
  
  processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. (c)
  
  processing is necessary for compliance with a legal obligation to which the controller is subject;
4. (d)
  
  processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. (e)
  
  processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  This is the case, when processing is necessary for the performance of a task carried out by a Member State related to national security (Article 4(2) TEU).
6. (f)
  
  processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
2.

Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.
3.
The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:
1. (a)
  
  Union law; or
2. (b)
  
  Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.
4.
Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:
1. (a)
  
  any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;
2. (b)
  
  the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;
3. (c)
  
  the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;
4. (d)
  
  the possible consequences of the intended further processing for data subjects;
5. (e)
  
  the existence of appropriate safeguards, which may include encryption or pseudonymisation.

Additional proposed wording Amendment 1008 ITRE · LIBE

In Article 6, paragraph 4, the following sentence is added

Where the intended further processing is compatible with the purposes for which the personal data were initially collected, it may rest on the legal basis that justified their collection; a separate legal basis shall not be required.

Preview
against:

Article 6

Lawfulness of processing

1.
Processing shall be lawful only if and to the extent that at least one of the following applies:
1. (a)
  
  the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. (b)
  
  processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. (c)
  
  processing is necessary for compliance with a legal obligation to which the controller is subject;
4. (d)
  
  processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. (e)
  
  processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. (f)
  
  processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
2.

Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.
3.
The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:
1. (a)
  
  Union law; or
2. (b)
  
  Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.
4.
Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:
1. (a)
  
  any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;
2. (b)
  
  the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;
3. (c)
  
  the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;
4. (d)
  
  the possible consequences of the intended further processing for data subjects;
5. (e)
  
  the existence of appropriate safeguards, which may include encryption or pseudonymisation.
6. Where the intended further processing is compatible with the purposes for which the personal data were initially collected, it may rest on the legal basis that justified their collection; a separate legal basis shall not be required.

Alternative wording Amendment 1011 ITRE · LIBE

(2b. Article 6 paragraph 1, point e), the following point is added:

"This is the case, when processing is necessary for the performance of a task carried out inby ~~the~~a ~~public~~Member ~~interest~~State orrelated to military and defence purposes as mentioned in ~~the~~Article ~~exercise~~42 ~~of official authority vested in the controller;~~TEU."

Justification

It should be made possible for Member State authorities to make use of the necessary personal and non-personal (mixed) datasets if it is used for military and defence purposes.

Preview
against:

Article 6

Lawfulness of processing

1.
Processing shall be lawful only if and to the extent that at least one of the following applies:
1. (a)
  
  the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. (b)
  
  processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. (c)
  
  processing is necessary for compliance with a legal obligation to which the controller is subject;
4. (d)
  
  processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. (e)
  
  This is the case, when processing is necessary for the performance of a task carried out inby ~~the~~a ~~public~~Member ~~interest~~State orrelated to military and defence purposes as mentioned in ~~the~~Article ~~exercise~~42 ~~of official authority vested in the controller;~~TEU.
6. (f)
  
  processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
2.

Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.
3.
The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:
1. (a)
  
  Union law; or
2. (b)
  
  Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.
4.
Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:
1. (a)
  
  any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;
2. (b)
  
  the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;
3. (c)
  
  the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;
4. (d)
  
  the possible consequences of the intended further processing for data subjects;
5. (e)
  
  the existence of appropriate safeguards, which may include encryption or pseudonymisation.

Alternative wording Amendment 1012 ITRE · LIBE

No2c. ~~equivalent~~Article 6, paragraph 1, point f, including the second subparagraph, is amended as follows:

(fa) processing is necessary for the anonymisation of personal data and that processing serves the principles of data minimisation or storage limitation. (2nd sub-paragaph) For the purposes of point f, controllers that are part of a group of undertakings within the meaning of Article 4, point 19, or institutions affiliated to a central body, shall be presumed to have a legitimate interest in transmitting personal data within that group or between such affiliated institutions for clearly defined internal administrative purposes, including central human resources management, financial and accounting administration, compliance monitoring, IT and cybersecurity management, internal audit, risk management and group reporting, provided that the processing is necessary and proportionate for those purposes and subject to appropriate technical and organisational safeguards. This presumption shall not affect the rights and freedoms of the data subject, including the right to object under Article 21, the processing of special categories of personal data under Article 9, the processing of personal data relating to criminal convictions and offences under Article 10, or the rules on transfers of personal data to third countries or international organisations under Chapter V. An illustrative list of legitimate interests within the meaning of point f of the first subparagraph is included in Annex II; the Commission is empowered to adopt delegated acts to amend Annex II by adding, deleting or modifying use-cases of legitimate interests, after having consulted the Board referred to in Article 68. Point f of the first subparagraph shall not apply to processing carried out by public authorities where they act in performance of sovereign powers."

Justification

The package makes Article 6 more predictable by clarifying that anonymisation may require a lawful processing step, recognising safeguarded intra-group administrative transfers, and adding a non-exhaustive Annex of legitimate-interest use cases. This supports consistent application across the Union without creating a blanket permission: necessity, proportionality and the balancing test remain required, especially for children. Commission updates after EDPB consultation keep the framework adaptable to new technologies and business practices. (see ANNEX 1a)

Preview
against:

Article 6

Lawfulness of processing

1.
Processing shall be lawful only if and to the extent that at least one of the following applies:
1. (a)
  
  the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. (b)
  
  processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. (c)
  
  processing is necessary for compliance with a legal obligation to which the controller is subject;
4. (d)
  
  processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. (e)
  
  processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. (f)
  processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
  1. (fa)
    
    processing is necessary for the anonymisation of personal data and that processing serves the principles of data minimisation or storage limitation.
  2. (2nd sub-paragaph) For the purposes of point f, controllers that are part of a group of undertakings within the meaning of Article 4, point 19, or institutions affiliated to a central body, shall be presumed to have a legitimate interest in transmitting personal data within that group or between such affiliated institutions for clearly defined internal administrative purposes, including central human resources management, financial and accounting administration, compliance monitoring, IT and cybersecurity management, internal audit, risk management and group reporting, provided that the processing is necessary and proportionate for those purposes and subject to appropriate technical and organisational safeguards. This presumption shall not affect the rights and freedoms of the data subject, including the right to object under Article 21, the processing of special categories of personal data under Article 9, the processing of personal data relating to criminal convictions and offences under Article 10, or the rules on transfers of personal data to third countries or international organisations under Chapter V.
  3. An illustrative list of legitimate interests within the meaning of point f of the first subparagraph is included in Annex II; the Commission is empowered to adopt delegated acts to amend Annex II by adding, deleting or modifying use-cases of legitimate interests, after having consulted the Board referred to in Article 68. Point f of the first subparagraph shall not apply to processing carried out by public authorities where they act in performance of sovereign powers."
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
2.

Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.
3.
The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:
1. (a)
  
  Union law; or
2. (b)
  
  Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.
4.
Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:
1. (a)
  
  any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;
2. (b)
  
  the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;
3. (c)
  
  the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;
4. (d)
  
  the possible consequences of the intended further processing for data subjects;
5. (e)
  
  the existence of appropriate safeguards, which may include encryption or pseudonymisation.

Additional proposed wording Amendment 1013 ITRE · LIBE

2d. In Article 6, the following paragraph 1a is inserted:

(1a)

For the purposes of paragraph 1, the creation of a permanent user account or the provision of personal data by the data subject may be required to access offers or to purchase goods or services only where strictly necessary. Where such access or purchase can be ensured without it, the controller shall offer the data subject a clear, easily accessible and non-discriminatory means to proceed, which shall not give rise to less favourable conditions for the data subject.'

Justification

Making access to an offer or the purchase of goods or services conditional on the creation of a permanent user account which is not necessary for the contract deprives consent of its free character, contrary to Article 7(4). The amendment requires the controller to offer a clear, easily accessible and non-discriminatory means to proceed without such an account, which may not give rise to less favourable conditions for the data subject. This is the 'guest experience' which the Court of Justice has already held to be required in comparable circumstances.

Preview
against:

Article 6

Lawfulness of processing

1.
Processing shall be lawful only if and to the extent that at least one of the following applies:
1. (a)
  
  the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. (b)
  
  processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. (c)
  
  processing is necessary for compliance with a legal obligation to which the controller is subject;
4. (d)
  
  processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. (e)
  
  processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. (f)
  
  processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
1a.

For the purposes of paragraph 1, the creation of a permanent user account or the provision of personal data by the data subject may be required to access offers or to purchase goods or services only where strictly necessary. Where such access or purchase can be ensured without it, the controller shall offer the data subject a clear, easily accessible and non-discriminatory means to proceed, which shall not give rise to less favourable conditions for the data subject.'
2.

Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.
3.
The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:
1. (a)
  
  Union law; or
2. (b)
  
  Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.
4.
Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:
1. (a)
  
  any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;
2. (b)
  
  the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;
3. (c)
  
  the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;
4. (d)
  
  the possible consequences of the intended further processing for data subjects;
5. (e)
  
  the existence of appropriate safeguards, which may include encryption or pseudonymisation.

Additional proposed wording Amendment 1015 ITRE · LIBE

2e. In Article 6, the following paragraph 4a is inserted:

Processing shall be regarded as necessary for the purposes of the legitimate interests pursued within the meaning of point (f) of paragraph 1 only where the following cumulative conditions are met:

(a)

the controller or a third party pursues a legitimate interest which is lawful, clearly and precisely articulated, and real and present rather than speculative;

(b)

the processing of personal data is necessary for that interest, and that interest cannot reasonably be achieved by other means less intrusive for the data subject, including through the use of anonymised, pseudonymised or synthetic data;

(c)

that interest is not overridden by the interests or fundamental rights and freedoms of the data subject, taking into account the nature of the data, the context of the processing, its possible consequences, and the reasonable expectations of the data subject based on their relationship with the controller.

Where the interests or fundamental rights and freedoms of the data subject would override the interest pursued, the controller may implement technical and organisational measures to mitigate the impact of the processing on the data subject; where such measures are insufficient, the processing shall not be based on point (f) of paragraph 1.'

Preview
against:

Article 6

Lawfulness of processing

1.
Processing shall be lawful only if and to the extent that at least one of the following applies:
1. (a)
  
  the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. (b)
  
  processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. (c)
  
  processing is necessary for compliance with a legal obligation to which the controller is subject;
4. (d)
  
  processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. (e)
  
  processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. (f)
  
  processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
2.

Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.
3.
The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:
1. (a)
  
  Union law; or
2. (b)
  
  Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.
4.
Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:
1. (a)
  
  any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;
2. (b)
  
  the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;
3. (c)
  
  the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;
4. (d)
  
  the possible consequences of the intended further processing for data subjects;
5. (e)
  
  the existence of appropriate safeguards, which may include encryption or pseudonymisation.
4a.
Processing shall be regarded as necessary for the purposes of the legitimate interests pursued within the meaning of point (f) of paragraph 1 only where the following cumulative conditions are met:
1. (a)
  
  the controller or a third party pursues a legitimate interest which is lawful, clearly and precisely articulated, and real and present rather than speculative;
2. (b)
  
  the processing of personal data is necessary for that interest, and that interest cannot reasonably be achieved by other means less intrusive for the data subject, including through the use of anonymised, pseudonymised or synthetic data;
3. (c)
  
  that interest is not overridden by the interests or fundamental rights and freedoms of the data subject, taking into account the nature of the data, the context of the processing, its possible consequences, and the reasonable expectations of the data subject based on their relationship with the controller.
4. Where the interests or fundamental rights and freedoms of the data subject would override the interest pursued, the controller may implement technical and organisational measures to mitigate the impact of the processing on the data subject; where such measures are insufficient, the processing shall not be based on point (f) of paragraph 1.'

Additional proposed wording Amendment 1016 ITRE · LIBE

2f. In Article 6, the following paragraph 4b is inserted:

Where personal data are collected from publicly accessible sources by means of web scraping for the purposes of developing or training an artificial intelligence system or model, the processing may be based on point f of paragraph 1 only where the conditions set out in paragraph 1a are met. In assessing whether the interests or fundamental rights and freedoms of the data subject override the interest pursued, account shall be taken in particular of:

(a)

the nature of the data, greater weight being given to data revealing highly private information;

(b)

the context of the processing, including the volume of data, the number of data subjects and the indiscriminate character of the collection;

(c)

the consequences for the data subject, including the difficulty of exercising their rights once the model is trained;

(d)

the reasonable expectations of the data subject, having regard to the nature of the source, the publicly accessible character of the data, whether the data subject has manifestly made the data public, and any technical restriction by which the source opposes scraping.

Consent shall not be inferred from the mere online accessibility of personal data, nor from the absence of a technical measure opposing scraping. Where the interests or fundamental rights and freedoms of the data subject would override the interest pursued, the controller may implement mitigating measures, including limiting collection to freely accessible data, excluding sources that oppose scraping, facilitating the right to object including prior to collection, and deleting or anonymising personal data as soon as possible; where such measures are insufficient, the processing shall not be based on point f of paragraph 1.'

Justification

Where personal data are collected from publicly accessible sources by means of web scraping for the purpose of developing or training an artificial intelligence system, reliance on legitimate interest remains subject to the conditions of Article 6(1a). The balancing test takes particular account of the nature of the data, the volume and indiscriminate character of the collection, the difficulty for the data subject of exercising their rights once the model is trained, and the reasonable expectations of the data subject, having regard to the nature of the source and to any technical restriction opposing scraping. The mere online accessibility of personal data does not constitute consent, nor does the absence of a robots.txt file. This codifies the EDPB Guidelines 03/2026.

Preview
against:

Article 6

Lawfulness of processing

1.
Processing shall be lawful only if and to the extent that at least one of the following applies:
1. (a)
  
  the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. (b)
  
  processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. (c)
  
  processing is necessary for compliance with a legal obligation to which the controller is subject;
4. (d)
  
  processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. (e)
  
  processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. (f)
  
  processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
2.

Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.
3.
The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:
1. (a)
  
  Union law; or
2. (b)
  
  Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.
4.
Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:
1. (a)
  
  any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;
2. (b)
  
  the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;
3. (c)
  
  the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;
4. (d)
  
  the possible consequences of the intended further processing for data subjects;
5. (e)
  
  the existence of appropriate safeguards, which may include encryption or pseudonymisation.
4b.
Where personal data are collected from publicly accessible sources by means of web scraping for the purposes of developing or training an artificial intelligence system or model, the processing may be based on point f of paragraph 1 only where the conditions set out in paragraph 1a are met. In assessing whether the interests or fundamental rights and freedoms of the data subject override the interest pursued, account shall be taken in particular of:
1. (a)
  
  the nature of the data, greater weight being given to data revealing highly private information;
2. (b)
  
  the context of the processing, including the volume of data, the number of data subjects and the indiscriminate character of the collection;
3. (c)
  
  the consequences for the data subject, including the difficulty of exercising their rights once the model is trained;
4. (d)
  
  the reasonable expectations of the data subject, having regard to the nature of the source, the publicly accessible character of the data, whether the data subject has manifestly made the data public, and any technical restriction by which the source opposes scraping.
5. Consent shall not be inferred from the mere online accessibility of personal data, nor from the absence of a technical measure opposing scraping. Where the interests or fundamental rights and freedoms of the data subject would override the interest pursued, the controller may implement mitigating measures, including limiting collection to freely accessible data, excluding sources that oppose scraping, facilitating the right to object including prior to collection, and deleting or anonymising personal data as soon as possible; where such measures are insufficient, the processing shall not be based on point f of paragraph 1.'

Additional proposed wording Amendment 1604 ITRE · LIBE

In Article 6, the following paragraph 3a is inserted:

Further processing of personal data for the sole purpose of anonymising those data shall be considered compatible with the purposes for which the personal data were initially collected and shall be lawful on the basis applicable to the initial processing.

Context reproduced in the official amendment

The amendment reproduces a wider legal passage. It is shown as context because it does not cover the same legal unit as the proposed wording.

The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:(a)Union law; or

Preview
against:

Article 6

Lawfulness of processing

1.
Processing shall be lawful only if and to the extent that at least one of the following applies:
1. (a)
  
  the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. (b)
  
  processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. (c)
  
  processing is necessary for compliance with a legal obligation to which the controller is subject;
4. (d)
  
  processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. (e)
  
  processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. (f)
  
  processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
2.

Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.
3.
The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:
1. (a)
  
  Union law; or
2. (b)
  
  Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.
3a.

Further processing of personal data for the sole purpose of anonymising those data shall be considered compatible with the purposes for which the personal data were initially collected and shall be lawful on the basis applicable to the initial processing.
4.
Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:
1. (a)
  
  any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;
2. (b)
  
  the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;
3. (c)
  
  the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;
4. (d)
  
  the possible consequences of the intended further processing for data subjects;
5. (e)
  
  the existence of appropriate safeguards, which may include encryption or pseudonymisation.

Selected texts

Compare wording

Choose a tracked part and a named pair of texts. Comparisons are offered only where both sides cover the same legal unit.

Select a specific tracked part above to compare wording.

Article 6 – paragraph 1 – point f –subparagraph

Wording reproduced in the amendment → Amendment 1012 · ITRE–LIBE amendments 777–1052 to the draft report

Changes in context

No2c. ~~equivalent~~Article 6, paragraph 1, point f, including the second subparagraph, is amended as follows: (fa) processing is necessary for the anonymisation of personal data and that processing serves the principles of data minimisation or storage limitation. (2nd sub-paragaph) For the purposes of point f, controllers that are part of a group of undertakings within the meaning of Article 4, point 19, or institutions affiliated to a central body, shall be presumed to have a legitimate interest in transmitting personal data within that group or between such affiliated institutions for clearly defined internal administrative purposes, including central human resources management, financial and accounting administration, compliance monitoring, IT and cybersecurity management, internal audit, risk management and group reporting, provided that the processing is necessary and proportionate for those purposes and subject to appropriate technical and organisational safeguards. This presumption shall not affect the rights and freedoms of the data subject, including the right to object under Article 21, the processing of special categories of personal data under Article 9, the processing of personal data relating to criminal convictions and offences under Article 10, or the rules on transfers of personal data to third countries or international organisations under Chapter V. An illustrative list of legitimate interests within the meaning of point f of the first subparagraph is included in Annex II; the Commission is empowered to adopt delegated acts to amend Annex II by adding, deleting or modifying use-cases of legitimate interests, after having consulted the Board referred to in Article 68. Point f of the first subparagraph shall not apply to processing carried out by public authorities where they act in performance of sovereign powers."

RemovedAdded

Both texts in full

Wording reproduced in the amendment

No equivalent

Amendment 1012 · ITRE–LIBE amendments 777–1052 to the draft report

2c. Article 6, paragraph 1, point f, including the second subparagraph, is amended as follows: (fa) processing is necessary for the anonymisation of personal data and that processing serves the principles of data minimisation or storage limitation. (2nd sub-paragaph) For the purposes of point f, controllers that are part of a group of undertakings within the meaning of Article 4, point 19, or institutions affiliated to a central body, shall be presumed to have a legitimate interest in transmitting personal data within that group or between such affiliated institutions for clearly defined internal administrative purposes, including central human resources management, financial and accounting administration, compliance monitoring, IT and cybersecurity management, internal audit, risk management and group reporting, provided that the processing is necessary and proportionate for those purposes and subject to appropriate technical and organisational safeguards. This presumption shall not affect the rights and freedoms of the data subject, including the right to object under Article 21, the processing of special categories of personal data under Article 9, the processing of personal data relating to criminal convictions and offences under Article 10, or the rules on transfers of personal data to third countries or international organisations under Chapter V. An illustrative list of legitimate interests within the meaning of point f of the first subparagraph is included in Annex II; the Commission is empowered to adopt delegated acts to amend Annex II by adding, deleting or modifying use-cases of legitimate interests, after having consulted the Board referred to in Article 68. Point f of the first subparagraph shall not apply to processing carried out by public authorities where they act in performance of sovereign powers."

Open official source ↗

Article 6

European Commission proposal

Council Presidency texts

European Parliament amendments

Article 6 – paragraph 1 a

Lawfulness of processing

Article 6 – paragraph 4 – point d

Lawfulness of processing

Article 6 – paragraph 1 – subparagraph 3

Lawfulness of processing

Article 6 – paragraph 1 – point e

Lawfulness of processing

Article 6 – paragraph 4 – subparagraph (new)

Lawfulness of processing

Article 6 – paragraph 1 – point e – second sentence

Lawfulness of processing

Article 6 – paragraph 1 – point f –subparagraph

Lawfulness of processing

Article 6 – Paragraph 1a (new)

Lawfulness of processing

Article 6 – Paragraph 4a (new)

Lawfulness of processing

Article 6 – Paragraph 4b (new)

Lawfulness of processing

Article 6 – paragraph 3a (new)

Lawfulness of processing

Compare wording

Changes in context

Wording reproduced in the amendment

Amendment 1011 · ITRE–LIBE amendments 777–1052 to the draft report

Changes in context

Wording reproduced in the amendment

Amendment 1012 · ITRE–LIBE amendments 777–1052 to the draft report