EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

GDPR· Article 70

Analysis in our dossiers
Breach reporting and practical compliance·Binding criteria and accountable enforcement

Text

Article 70 GDPR as printed in the Council text of 22 October 2026

Tasks of the Board

Source Council, 22 October 2026. Article 70: ST 14756/26, page 142 · exact text page

Article 70(1)(f)

(f)

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for further specifying the criteria and conditions for decisions based on profiling pursuant to Article 22(1);

Article 70(1)(h)

The Council draft deletes this provision and supplies no replacement wording. Open the official source to read the instruction in context.

The amending passage as printed

13.

Article 70(1)(ha)

‘(ha)

establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35.

Article 70(1)(haa)

(1)(haa)

haa establish a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33 and a list of the circumstances in which it is not likely to result in such a high risk.

Article 70(1)(hb)

(hb)

prepare and transmit to the Commission a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

Article 70(1)(hc)

(hc)

prepare and transmit to the Commission a common template for notifying a personal data breach to the competent supervisory authority pursuant to Article 33.

Article 70(1)(hca)

(hca)

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose of further specifying the appropriate technical and organisational measures to ensure a level of security appropriate to the level of risk pursuant to Article 32.

Article 70(1)(hcb)

(hcb)

issue the opinion on the application of pseudonymisation and anonymisation referred to in Article 25a.’

Article 70 in the whole GDPR

How the provision changed

Show the statuses

Each text against the law in forceEach text against the text before it

What each text would do to the law in force
Element Commission19 Nov 2025Art 70 Council21 May 2026Art 70 Council10 Jun 2026Art 70 Council18 Jun 2026Art 70 Council3 Sep 2026Art 70 Council2 Oct 2026Art 70 Council22 Oct 2026Art 70
Compared withlaw in forcethe proposal21 May text10 Jun text18 Jun text3 Sep text2 Oct text
From the Commission’s Article 70
Impact-assessment lists
70(1)(ha) Adds Added
70(1)(ha) Adds, changed since the proposal Changed
70(1)(ha) Adds Unchanged
70(1)(ha) Adds Unchanged
Not established Not established
70(1)(ha) Adds Unchanged
70(1)(ha) Adds Unchanged
Impact-assessment template and methodology
70(1)(hb) Adds Added
70(1)(hb) Adds, changed since the proposal Changed
70(1)(hb) Adds Unchanged
70(1)(hb) Adds Unchanged
70(1)(hb) Adds, changed since 18 Jun Changed
70(1)(hb) Adds Unchanged
70(1)(hb) Adds Unchanged
Breach-notification template and high-risk lists
70(1)(hc) Adds Added
70(1)(hc) Adds, changed since the proposal Changed
70(1)(hc) Adds Unchanged
70(1)(hc) Adds Unchanged
70(1)(haa) Adds, changed since 18 Jun Changed
70(1)(haa) Adds Unchanged
70(1)(haa) Adds Unchanged
Added in the Council texts
Guidelines on decisions based on profiling
Not in the law in force or this text In neither text
70(1)(f) Adds, added since the proposal Added
70(1)(f) Adds Unchanged
70(1)(f) Adds Unchanged
70(1)(f) Adds Unchanged
70(1)(f) Adds Unchanged
70(1)(f) Adds Unchanged
Proposal for a breach-notification template
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
70(1)(hc) Adds, added since 18 Jun Added
70(1)(hc) Adds Unchanged
70(1)(hc) Adds Unchanged
“(hca) issue guidelines, recommendations and best practices …”
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
70(1)(hca) Adds, added since 18 Jun Added
70(1)(hca) Adds Unchanged
70(1)(hca) Adds Unchanged
“(hcb) issue the opinion on the application …”
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
70(1)(hcb) Adds, added since 18 Jun Added
70(1)(hcb) Adds Unchanged
70(1)(hcb) Adds Unchanged

Each text against the law in force: +Adds adds a provision the law in force lacks◌Not established the source drops it, not yet reviewed— neither the law in force nor the text has it changed from the text before

Each text against the text before it: +Added in this text, not in the text before~Changed wording changed=Unchanged same as the text before◌Not established the source drops it, not yet reviewed— in neither text

Council text of 21 May 2026 · ST 9547/26 ST 9547/26 reproduces only some of the proposal’s changes, so this comparison applies only those it shows or visibly drops. It says nothing about the others.

Council text of 2 October 2026 · ST 13886/26 Page 126 prints “(9a)” without an instruction or target, so no change can be assigned to that marker.

Parliament amendments

30 amendments to this article

5 would delete the wording, 19 propose alternative wording and 6 would add wording.

By political group; co-sponsored amendments count for each group
TypeThe LeftS&DGreens/EFARenewEPPECRPfERapporteur
− Deletion2··1·12·
~ Alternative·3336··4
+ Addition·111112·

By political group

  • − Deletion The Left 2 Renew 1 ECR 1 PfE 2
  • ~ Alternative S&D 3 Greens/EFA 3 Renew 3 EPP 6 Rapporteur 4
  • + Addition S&D 1 Greens/EFA 1 Renew 1 EPP 1 ECR 1 PfE 2

Show

Paragraph (1)(b)1 amendment

  1. 1321 Alternative Marina Kaljurand +8S&D · ITRE–LIBE “and the confidentiality of communications”

    12a. In Article 70 paragraph 1, point b is replaced by the following:

    (b) advise the Commission on any issue related to the protection of personal data and the confidentiality of communications in the Union, including on any proposed amendment of this Regulation;"

    Justification

    This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.

    Tabled by
    Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
    Group
    S&D
    Targets
    GDPR Article 70 – paragraph 1 – point b
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 12 a (new) / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point b

Paragraph (1)(e)1 amendment

  1. 1320 Alternative Axel VossEPP · ITRE–LIBE “in doing so, the Board shall ensure that such guidance: i. remains consistent with the wording, scope, objectives, and risk-based structure of this…”

    12a. In Article 70, paragraph 1, point e is amendend as follows:

    (e) examine, on its own initiative, on request of one of its members or on request of the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation; in doing so, the Board shall ensure that such guidance: i. remains consistent with the wording, scope, objectives, and risk-based structure of this Regulation, ii. respects the principles of proportionality and legal certainty and does not introduce substantive obligations beyond those laid down in Union law, iii. is accompanied by a published legal assessment confirming its legal basis, feasibility, and conformity with the principles of this Regulation, iv. where applicable, informed by, and coordinated with relevant competent sectoral authorities."

    Justification

    INNOVATION PACKAGE #7: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 70 – paragraph 1 – point e
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 12 a (new) / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point e

Paragraph (1)(h)5 amendments

  1. 403 Deletion Virginie JoronPfE · IMCO Deletes the Commission’s wording

    13. In Article 70(1), point (h) is deleted.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 70(1)(h)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 13 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point h
  2. 1322 Deletion Irena Joveva +5Renew · ITRE–LIBE Deletes the Commission’s wording

    13. In Article 70(1), point (h) is deleted.

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 70(1)(h)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 13 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point h
  3. 1323 Deletion Julie Rechagneux +7ECR, PfE · ITRE–LIBE Deletes the Commission’s wording

    13. In Article 70(1), point (h) is deleted.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 70(1)(h)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 13 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point h
  4. 1324 Deletion Pernando Barrena ArzaThe Left · ITRE–LIBE Deletes the Commission’s wording

    13. In Article 70(1), point (h) is deleted.

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    GDPR Article 70(1)(h)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 13 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point h
  5. 1341 Addition Irena Joveva +5Renew · ITRE–LIBE “Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory…”

    14a.In Article 77, paragraph 1 is replaced by the following:

    Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. This right to lodge a complaint also applies when the infringing processing of personal data relating to the data subject is imminent or will take place in the near future.

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 70
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 a (new) / Regulation (EU) 2016/679 / Article 70 – paragraph 1

Paragraph (1)(ha)6 amendments

  1. 64 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no…”

    (ha) prepare and transmit to the Commission a proposal forestablish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 70(1)(ha)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point h a
  2. 404 Addition Virginie JoronPfE · IMCO “publish guidelines on the pseudonymisation and anonymisation of personal data, including in connection with the development and use of AI models and…”

    (hca)publish guidelines on the pseudonymisation and anonymisation of personal data, including in connection with the development and use of AI models and systems, and on residual reidentification risk assessments, taking into account the means reasonably likely to be used;

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 70
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1
  3. 1325 Deletion Pernando Barrena ArzaThe Left · ITRE–LIBE Deletes the Commission’s wording

    14. In Article 70(1), the following points are inserted: (ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35. (hb) prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35. (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33’

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    GDPR Article 70
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – points ha, hb, hc
  4. 1326 Alternative Oliver Schenk +12EPP · ITRE–LIBE “establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment, pursuant to…”

    (ha) prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment, pursuant to Article 35.

    Tabled by
    Oliver Schenk, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig, François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 70(1)(ha)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point ha
  5. 1327 Alternative Irena Joveva +5Renew · ITRE–LIBE “establish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no…”

    (ha) prepare and transmit to the Commission a proposal forestablish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and for which no data protection impact assessment is required, pursuant to Article 35.

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 70(1)(ha)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point ha
  6. 1328 Alternative Markéta GregorováGreens/EFA · ITRE–LIBE “a list of processing operations”

    (ha) prepare and transmit to the Commission a proposal forestablish a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment and a list of processing operations for which no data protection impact assessment is required, pursuant to Article 35.

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 70(1)(ha)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point ha

Paragraph (1)(hb)4 amendments

  1. 65 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.”

    (hb) prepare and transmit to the Commission a proposal forestablish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 70(1)(hb)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point h b
  2. 1329 Alternative Markéta GregorováGreens/EFA · ITRE–LIBE “establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.”

    (hb) prepare and transmit to the Commission a proposal forestablish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 70(1)(hb)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point hb
  3. 1330 Alternative Irena Joveva +5Renew · ITRE–LIBE “establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.”

    (hb) prepare and transmit to the Commission a proposal forestablish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 70(1)(hb)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point hb
  4. 1331 Alternative Oliver Schenk +12EPP · ITRE–LIBE “establish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.”

    (hb) prepare and transmit to the Commission a proposal forestablish a common template and a common methodology for conducting data protection impact assessments, pursuant to Article 35.

    Tabled by
    Oliver Schenk, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig, François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 70(1)(hb)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point hb

Paragraph (1)(hc)8 amendments

  1. 66 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “establish a common template for notifying a personal data breach to the competent supervisory authority as well as a list of the circumstances in…”

    (hc) prepare and transmit to the Commission a proposal forestablish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 70(1)(hc)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point h c
  2. 1332 Alternative Marina Kaljurand +8S&D · ITRE–LIBE “a list of the circumstances in which it is not likely to result in a high risk, and a list of the circumstances in which it is not likely to result…”

    (hc) prepare and transmit to the Commission a proposal forestablish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33, a list of the circumstances in which it is not likely to result in a high risk, and a list of the circumstances in which it is not likely to result in any risk.

    Tabled by
    Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
    Group
    S&D
    Targets
    GDPR Article 70(1)(hc)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point hc
  3. 1333 Alternative Henrik DahlEPP · ITRE–LIBE “and a list of the circumstances in which it is not likely to result in a high risk.”

    (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33 and a list of the circumstances in which it is not likely to result in a high risk.

    Tabled by
    Henrik Dahl
    Group
    EPP
    Targets
    GDPR Article 70(1)(hc)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point hc
  4. 1334 Alternative Markéta GregorováGreens/EFA · ITRE–LIBE “establish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in…”

    (hc) prepare and transmit to the Commission a proposal forestablish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 70(1)(hc)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point hc
  5. 1335 Alternative Tomas Tobé +2EPP · ITRE–LIBE “prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority…”

    (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely and not likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

    Tabled by
    Tomas Tobé, Arba Kokalari, Jörgen Warborn
    Group
    EPP
    Targets
    GDPR Article 70(1)(hc)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point hc
  6. 1336 Alternative Oliver Schenk +11EPP · ITRE–LIBE “establish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in…”

    (hc) prepare and transmit to the Commission a proposal forestablish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

    Tabled by
    Oliver Schenk, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig
    Group
    EPP
    Targets
    GDPR Article 70(1)(hc)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point hc
  7. 1337 Alternative Irena Joveva +5Renew · ITRE–LIBE “establish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in…”

    (hc) prepare and transmit to the Commission a proposal forestablish a common template for notifying a personal data breach to the competent supervisory authority as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 70(1)(hc)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point hc
  8. 1338 Alternative Alex Agius SalibaS&D · ITRE–LIBE “prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority…”

    (hc) prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority as well as for a listlists of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person pursuant to Article 33

    Justification

    To include both a white and a black list to help companies/contribute to legal certainty and more harmonisation across the EU

    Tabled by
    Alex Agius Saliba
    Group
    S&D
    Targets
    GDPR Article 70(1)(hc)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point hc

New points in paragraph 12 amendments

  1. 1339 Addition Marina Kaljurand +8S&D · ITRE–LIBE “issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for further specifying the criteria and…”

    (hca) In Article 70, the following point is inserted:

    (hca)issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for further specifying the criteria and conditions for lawful processing of electronic communications data pursuant to Article 91b and the protection of information transmitted to, stored in, related to, processed by and collected from users’ terminal equipment pursuant to Article 91c;'

    Justification

    This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.

    Tabled by
    Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
    Group
    S&D
    Targets
    GDPR Article 70 – paragraph 1 – point hca (new)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 / Article 70 – paragraph 1 – point hca (new)
  2. 1340 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “issue guidelines on the pseudonymisation and anonymisation of personal data, including in the context of the development and operation of AI systems…”

    (hca) In Article 70, the following point is inserted:

    (hca)issue guidelines on the pseudonymisation and anonymisation of personal data, including in the context of the development and operation of AI systems and models, and on the assessment of the residual risk of re-identification, taking into account the means reasonably likely to be used;'

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 70 – paragraph 1 – point hca (new)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 / Regulation (EU) 2016/679 (GDPR) / Article 70 – paragraph 1 – point hca (new)

Paragraph (3)2 amendments

  1. 67 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “The Board shall forward its opinions, guidelines, recommendations, templates, lists and best practices to the Commission and to the committee…”

    14a. in Article 70, paragraph 3 is replaced by the following:

    3. The Board shall forward its opinions, guidelines, recommendations, templates, lists and best practices to the Commission and to the committee referred to in Article 93 and make them public.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 70 – paragraph 3
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 14 a (new) / Regulation (EU) 2016/679 / Article 70 – paragraph 3
  2. 1343 Addition Markéta GregorováGreens/EFA · ITRE–LIBE “The Board shall forward its opinions, guidelines, recommendations, common templates, lists, common methodologies and best practices to the Commission…”

    14a. In Article 70, paragraph 3 is replaced by the following:

    The Board shall forward its opinions, guidelines, recommendations, common templates, lists, common methodologies and best practices to the Commission and to the committee referred to in Article 93 and make them public.

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 70 – paragraph 3
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 a (new) / Regulation (EU) 2016/679 / Article 70 – paragraph 3

New paragraphs1 amendment

  1. 1357 Addition Axel VossEPP · ITRE–LIBE “In fullfilling ist tasks the Board takes into account that the right to the protection of personal data is not an absolute right and must be…” numbered 4a

    14f.In Article 70, paragraphs 4a and 4b are added:

    4a.In fullfilling ist tasks the Board takes into account that the right to the protection of personal data is not an absolute right and must be considered in relation to its function in society and balanced against other fundamental rights, in accordance with the principle of proportionality. The Board must have inter alia regard of the following as far as relevant in the specific circumstances:

    (a)the desirability of promoting innovation;

    (b)the desirability of promoting competition;

    (c)the importance of the prevention, investigation, detection and prosecution of criminal offences;

    (d)the need to safeguard public security and national security;

    (e)the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing.

    4b.The Board shall establish a permanent panel of stakeholder representatives to ensure that it fulfills its tasks, especially regarding the matters described in paragraph 5 duely and monitor relevant developments, insofar as they have an impact on the protection of personal data and the free flow of personal dada, in particular the development of information and communication technologies and commercial practices. The Commission may adopt, by means of an implementing act, rules for the appointement and the statue oft he members oft he panel and procedural requirements which ensure professional secrecy and transparency.

    Justification

    INNOVATION PACKAGE #8: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 70 – paragraphs 4a, 4b (new)
    Document
    ITRE–LIBE amendments 1261–1564 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 14 f (new) / Regulation (EU) 2016/679 / Article 70 – paragraphs 4a, 4b (new)