EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

GDPR· Article 9

Analysis in our dossiers
Where the file stands·AI development and residual sensitive data·Breach reporting and practical compliance

Text

Article 9 GDPR as printed in the Council text of 22 October 2026

Processing of special categories of personal data

Source Council, 22 October 2026. Article 9: ST 14756/26, page 132 · pp. 132–133 · exact text page

Scope This text prints Article 9(2)(k), Article 9(2)(l), Article 9(5) only.

Article 9(2)(k)

‘(k)

incidental processing of residual data, where not intended by the controller, in the context of the development and technical operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model as referred to in Regulation (EU) 2024/1689, subject to the conditions referred to in paragraph 5.

Article 9(2)(l)

(l)

processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the one-to-one verification is under the sole control of the data subject and, where applicable, subject to appropriate safeguards to protect the fundamental rights and the interests of the data subject as laid down in Union law or Member State law, in accordance with paragraph 4 of this Article.’

Article 9(5)

5.

For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data that are incidentally and residually involved in the datasets used for the development of and technical operation of the AI system or AI model, including training, validation and testing, the controller shall erase such data without undue delay. If erasure of those data proves to be technically impossible or requires manifestly disproportionate effort, the controller shall, without undue delay and in any event, effectively protect such data from being further processed or processed for other purposes, used to produce outputs, disclosed or otherwise made available to third parties.

Article 9 in the whole GDPR

How each paragraph has changed

Show the statuses
What each text would do to the law in force
Paragraph Commission19 Nov 2025Council21 May 2026Council10 Jun 2026Council18 Jun 2026Council3 Sep 2026Council2 Oct 2026Council22 Oct 2026 Parliamentamendments
Compared withlaw in forcethe proposal21 May text10 Jun text18 Jun text3 Sep text2 Oct text
2Points (k) and (l) Adds Added Adds , changed since the proposal Changed Adds , changed since 21 May Changed Adds Unchanged Adds , changed since 18 Jun Changed Adds , changed since 3 Sep Changed Adds Unchanged 37
5Paragraph 5 Adds Added Adds , changed since the proposal Changed Adds , changed since 21 May Changed Adds Unchanged Adds , changed since 18 Jun Changed Adds , changed since 3 Sep Changed Adds Unchanged 25
Provisions only Parliament would add or change5 units Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text 10

Each text against the law in force: +Adds adds a provision the law in force lacks— neither the law in force nor the text has it changed from the text before

Each text against the text before it: +Added in this text, not in the text before~Changed wording changed=Unchanged same as the text before— in neither text

What each text does

  1. 19 Nov 2025 Commission proposalCOM(2025) 837 Adds Adds points (k) and (l) of paragraph 2 and paragraph 5. Article 9 in this text
  2. 21 May 2026 Council textST 9547/26 Changed Changes points (k) and (l) of paragraph 2 and paragraph 5.ST 9547/26 reproduces only some of the proposal’s changes, so this comparison applies only those it shows or visibly drops. It says nothing about the others. Article 9 in this text
  3. 8 Jun 2026 IMCO draft opinion · Alex Agius Saliba (rapporteur)IMCO-PA-789877 3 amendments to this article. Amendments in this document
  4. 10 Jun 2026 Council textST 10426/26 Changed Changes points (k) and (l) of paragraph 2 and paragraph 5. Article 9 in this text
  5. 18 Jun 2026 Council textST 10677/26 Unchanged Same as the text before. Article 9 in this text
  6. 22 Jun 2026 ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)CJ72-PR-786818 1 amendment to this article. Amendments in this document
  7. 29 Jun 2026 JURI amendments 69–296 to the draft opinionJURI-AM-790236 4 amendments to this article. Amendments in this document
  8. 16 Jul 2026 IMCO amendments 329–532 to the draft opinionIMCO-AM-791061 11 amendments to this article. Amendments in this document
  9. 27 Jul 2026 ITRE–LIBE amendments 777–1052 to the draft reportCJ72-AM-791072 35 amendments to this article. Amendments in this document
  10. 27 Jul 2026 ITRE–LIBE amendments 1053–1260 to the draft reportCJ72-AM-791073 17 amendments to this article. Amendments in this document
  11. 27 Jul 2026 ITRE–LIBE amendments 1565–1740 to the draft reportCJ72-AM-791874 1 amendment to this article. Amendments in this document
  12. 3 Sep 2026 Council textST 12535/26 Changed Changes points (k) and (l) of paragraph 2 and paragraph 5. Article 9 in this text
  13. 2 Oct 2026 Council textST 13886/26 Changed Changes points (k) and (l) of paragraph 2 and paragraph 5.Page 126 prints “(9a)” without an instruction or target, so no change can be assigned to that marker. Article 9 in this text
  14. 22 Oct 2026 Council textST 14756/26 Unchanged Same as the text before. Article 9 in this text

Paragraph 2: Points (k) and (l)

Added by the Commission · changed by the Council on 21 May · changed on 10 June · changed on 3 September · changed on 2 October

Parliament amendments 37

13 would delete the wording, 16 propose alternative wording and 8 would add wording to paragraph 2. Deletion amendments come from The Left, S&D, Greens/EFA, ESN and non-attached members, and from the IMCO rapporteur’s draft opinion.

By political group; co-sponsored amendments count for each group
TypeThe LeftS&DGreens/EFARenewEPPECRPfEESNNIRapporteur
− Deletion512····131
~ Alternative1·134331·2
+ Addition····8·····

By political group

  • − Deletion The Left 5 S&D 1 Greens/EFA 2 ESN 1 NI 3 Rapporteur 1
  • ~ Alternative The Left 1 Greens/EFA 1 Renew 3 EPP 4 ECR 3 PfE 3 ESN 1 Rapporteur 2
  • + Addition EPP 8

Show

  1. 46 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “subject to appropriate safeguards laid down in Union law to protect the fundamental rights and the interests of the data subject”

    (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the one-to-one verification is under the sole control of the data subject, subject to appropriate safeguards laid down in Union law to protect the fundamental rights and the interests of the data subject.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 9(2)(l)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point l
  2. 99 Alternative Alex Agius Saliba (rapporteur)Rapporteur · IMCO “in paragraph 2, the following points is added:”

    (a) in paragraph 2, the following points areis added:

    Rapporteur
    Alex Agius Saliba
    Group
    Rapporteur
    Targets
    GDPR Article 9
    Document
    IMCO draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point a – introductory part / Regulation (EU) 2016/679 / Article 9 – paragraph 2
  3. 100 Deletion Alex Agius Saliba (rapporteur)Rapporteur · IMCO Deletes the Commission’s wording

    (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.

    Justification

    Deletion because it would amount to a an ‘AI privilege’ difficult to meet EU principles of necessity and proportionality, affecting the overall level of the protection of consumer’s personal data.

    Rapporteur
    Alex Agius Saliba
    Group
    Rapporteur
    Targets
    GDPR Article 9(2)(k)
    Document
    IMCO draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point k
  4. 239 Deletion Arash SaeidiThe Left · JURI Deletes the Commission’s wording

    (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.

    Tabled by
    Arash Saeidi
    Group
    The Left
    Targets
    GDPR Article 9(2)(k)
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 3 – paragraph 3 – point (k)
  5. 240 Deletion Arash SaeidiThe Left · JURI Deletes the Commission’s wording

    (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.

    Tabled by
    Arash Saeidi
    Group
    The Left
    Targets
    GDPR Article 9(2)(l)
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 3 – paragraph 3 – point (l)
  6. 362 Deletion Kateřina KonečnáNI · IMCO Deletes the Commission’s wording

    (a) in paragraph 2, the following points are added: (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5. (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.’

    Tabled by
    Kateřina Konečná
    Group
    NI
    Targets
    GDPR Article 9
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2
  7. 363 Deletion David CormandGreens/EFA · IMCO Deletes the Commission’s wording

    (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.

    Tabled by
    David Cormand on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 9(2)(k)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9
  8. 364 Alternative Virginie JoronPfE · IMCO “and without prejudice to the prohibited practices outlined in Article 5 of Regulation (EU) 2024/1689, the rules for classifying high-risk AI systems…”

    (k) processing in the context of the development and operation of an innovative system or technology required to pursue the legitimate interests of the controller or a third party, irrespective of whether this system or technology exists upon the date when this Regulation is adopted, a current example of which is an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5;, and without prejudice to the prohibited practices outlined in Article 5 of Regulation (EU) 2024/1689, the rules for classifying high-risk AI systems laid down in Article 6, the obligations imposed on deployers of high-risk AI systems in Article 26 and the transparency obligations laid down in Article 50 of this Regulation.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 9(2)(k)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point k
  9. 365 Addition Arba KokalariEPP · IMCO “processing is necessary for the purposes of carrying out obligations set by other internal market and customs union law, where there are no…”

    (lb)processing is necessary for the purposes of carrying out obligations set by other internal market and customs union law, where there are no cross-references to Regulation (EU) 2016/679;

    Tabled by
    Arba Kokalari
    Group
    EPP
    Targets
    GDPR Article 9
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – Paragraph 2
  10. 1018 Deletion João OliveiraThe Left · ITRE–LIBE Deletes the Commission’s wording

    (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.

    Tabled by
    João Oliveira
    Group
    The Left
    Targets
    GDPR Article 9(2)(k)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point k
Show 27 more amendments
  1. 1019 Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the Commission’s wording

    (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    GDPR Article 9(2)(k)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point k
  2. 1020 Deletion Mary KhanESN · ITRE–LIBE Deletes the Commission’s wording

    (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.

    Justification

    Specific categories of data shall not become the general data base for AI. A subsequent removal, which may be waived in the event of ‘disproportionate effort’, does not constitute effective protection.

    Tabled by
    Mary Khan
    Group
    ESN
    Targets
    GDPR Article 9(2)(k)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point k
  3. 1021 Deletion Pernando Barrena ArzaThe Left · ITRE–LIBE Deletes the Commission’s wording

    (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    GDPR Article 9(2)(k)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 –point k
  4. 1022 Deletion Marina Kaljurand +8S&D · ITRE–LIBE Deletes the Commission’s wording

    (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.

    Tabled by
    Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
    Group
    S&D
    Targets
    GDPR Article 9(2)(k)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point k
  5. 1023 Deletion Markéta GregorováGreens/EFA · ITRE–LIBE Deletes the Commission’s wording

    (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 9(2)(k)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point k
  6. 1024 Alternative Julie Rechagneux +7ECR, PfE · ITRE–LIBE “and without prejudice to the prohibited practices laid down in Article 5 of Regulation (EU) 2024/1689, the classification rules for high-risk AI…”

    (k) processing in the context of the development and operation of an innovative system or technology that is necessary for the legitimate interests pursued by the controller or by a third party, whether or not such system or technology exists at the time of adoption of this Regulation, of which an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model is a current example, subject to the conditions referred to in paragraph 5, and without prejudice to the prohibited practices laid down in Article 5 of Regulation (EU) 2024/1689, the classification rules for high-risk AI systems laid down in Article 6, the obligations of deployers of high-risk AI systems laid down in Article 26, and the transparency obligations laid down in Article 50 of that Regulation.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 9(2)(k)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point k
  7. 1025 Alternative Aura Salla +8EPP · ITRE–LIBE “as referred to in Regulation (EU) 2024/1689, including for the improvement of such systems or models and of related products or services”

    (k) incidental and residual processing in the context of the development, training, testing, deployment and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model as referred to in Regulation (EU) 2024/1689, including for the improvement of such systems or models and of related products or services, subject to the conditions referred to in paragraph 5.

    Tabled by
    Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Adina Vălean, Henrik Dahl, Andrea Wechsler, Oliver Schenk, Pekka Toveri, Christian Ehler
    Group
    EPP
    Targets
    GDPR Article 9(2)(k)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point k
  8. 1026 Alternative Irena Joveva +5Renew · ITRE–LIBE “strictly incidental and residual”

    (k) strictly incidental and residual processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5.

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 9(2)(k)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9– paragraph 2 – point k
  9. 1027 Alternative Axel VossEPP · ITRE–LIBE “processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or a GPAI…”

    (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or ana AIGPAI model, subject to the conditions referred to in paragraph 5.

    Justification

    The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 9(2)(k)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point k
  10. 1028 Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the Commission’s wording

    (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.’

    Justification

    In practice, alternative means of identification are almost always available, so the use of biometric data is by no means ‘necessary’. Establishing the ‘necessity’ of the use would also normalise the use of biometric data, which should be avoided.

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    GDPR Article 9(2)(l)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point l
  11. 1029 Deletion Pernando Barrena ArzaThe Left · ITRE–LIBE Deletes the Commission’s wording

    (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    GDPR Article 9(2)(l)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point l
  12. 1030 Alternative Markéta GregorováGreens/EFA · ITRE–LIBE “and the following conditions are met: (i) the identity confirmation is required by Union or Member Statea national law providing suitable and…”

    (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.processing of biometric data is necessary for the purpose of confirming the identity of a data subject (one-to-one verification), and the following conditions are met: (i) the identity confirmation is required by Union or Member Statea national law providing suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; (ii) the biometric data and the means needed for the verification are under the sole control of the data subject; (iii) the controller can demonstrate that there are no less intrusive alternative solutions that could achieve the same objective as effectively; and (iv) the biometric data is deleted after the verification process has been completed.

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 9(2)(l)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point l
  13. 1031 Alternative Nadine MoranoEPP · ITRE–LIBE “Where biometric verification is part of an access control process within strategic public transport infrastructure, the storage of biometric data and…”

    (l) processing of biometric data is necessaryauthorised forwhen theit purposeis ofused confirmingto confirm the identity of a data subject (verification), whereprovided that the biometric data or the means needed for thethat verification isremain under the sole control of the data subject. Where biometric verification is part of an access control process within strategic public transport infrastructure, the storage of biometric data and the means necessary for verification may be under the exclusive control of the controller, provided that such processing is strictly necessary and proportionate, ensures a high level of security, including robust encryption, strict access controls and protection against cyberattacks, and fully respects the fundamental rights and freedoms of the data subjects concerned.

    Tabled by
    Nadine Morano
    Group
    EPP
    Targets
    GDPR Article 9(2)(l)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point l
  14. 1032 Alternative João OliveiraThe Left · ITRE–LIBE “subject to appropriate safeguards to protect the fundamental rights and the interests of the data subject, and provided that the processing is in…”

    (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the ‘one-to-one’ verification is under the sole control of the data subject, subject to appropriate safeguards to protect the fundamental rights and the interests of the data subject, and provided that the processing is in accordance with this Regulation and does not constitute a new derogation from the prohibition provided for in Article 9(1).’

    Tabled by
    João Oliveira
    Group
    The Left
    Targets
    GDPR Article 9(2)(l)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 8 – paragraph 2 – point l
  15. 1033 Alternative Jan-Christoph Oetjen +2Renew · ITRE–LIBE “has access to a non-biometric alternative of comparable effectiveness and that no photo or video is captured from individuals who do not consent to”

    (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.processing of biometric data is necessary for the purpose of verifying the identity or identifying a data subject, provided that biometric data is optional, the data subject has access to a non-biometric alternative of comparable effectiveness and that no photo or video is captured from individuals who do not consent to the facial recognition, and that appropriate safeguards laid down under Union law are applied to ensure the protection of fundamental rights of the data subject.

    Tabled by
    Jan-Christoph Oetjen, Svenja Hahn, Andreas Glück
    Group
    Renew
    Targets
    GDPR Article 9(2)(l)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 (GDPR) / Article 9 – paragraph 2 – point l
  16. 1034 Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “and occurs on the data subject’s device, except in highly exceptional cases where this is strictly necessary, proportional and uses state of the art…”

    (l) processing of biometric data is strictly necessary for the purpose of confirming the identity of a data subject (using one-to-one verification), where the biometric data or the means needed for the verificationrecognition is under the sole control of the data subject and occurs on the data subject’s device, except in highly exceptional cases where this is strictly necessary, proportional and uses state of the art privacy preserving technology, such as encryption and zero knowledge proofs.

    Tabled by
    Sebastian Tynkkynen, Diego Solier
    Group
    ECR
    Targets
    GDPR Article 9(2)(l)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 1 – point a
  17. 1035 Alternative Irena Joveva +5Renew · ITRE–LIBE “and subject to appropriate safeguards to protect the fundamental rights and the interests of the data subject, as laid down in Union law or Member…”

    (l) processing of biometric data is strictly necessary and proportionate for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject and subject to appropriate safeguards to protect the fundamental rights and the interests of the data subject, as laid down in Union law or Member State law, in accordance with paragraph 4 of this article.

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 9(2)(l)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point l
  18. 1036 Alternative Axel VossEPP · ITRE–LIBE “non-biometric alternative of comparable effectiveness is available to the”

    (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.processing of biometric data for the purposes of uniquely identifying a natural person provided that the use of biometric data is not mandatory, that a non-biometric alternative of comparable effectiveness is available to the data subject and that appropriate safeguards are applied to protect the fundamental rights and interests of the data subject.

    Justification

    The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 9(2)(l)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point l
  19. 1037 Alternative Mary KhanESN · ITRE–LIBE “and the biometric data is neither centrally stored nor further processed for any other purpose”

    (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject and the biometric data is neither centrally stored nor further processed for any other purpose.’

    Tabled by
    Mary Khan
    Group
    ESN
    Targets
    GDPR Article 9(2)(l)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point 1
  20. 1038 Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or…”

    (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the one-to-one verification is under the sole control of the data subject.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 9(2)(l)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2
  21. 1039 Addition Axel VossEPP · ITRE–LIBE “processing is necessary for the development, testing, validation, deployment or improvement of technologies directly or indirectly serving an…”

    (la)processing is necessary for the development, testing, validation, deployment or improvement of technologies directly or indirectly serving an important public-benefit purpose, provided that:

    (i)the processing does not pursue a direct identification of data subjects and a direct allocation of special categories of personal data to an individual person;

    (ii)the controller does not take decisions producing legal effects or similarly significant effects concerning identified natural persons on the basis of such processing;

    (iii)the processing is limited to what is necessary for the relevant public-benefit purpose; and

    (iv)appropriate technical and organisational safeguards are applied, including data minimisation, access restrictions and, where feasible, pseudonymisation or anonymisation.

    Justification

    The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 9 – paragraph 2 – point la (new)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point la (new)
  22. 1040 Addition Aura Salla +6EPP · ITRE–LIBE “processing is strictly necessary for the recognition, management or payment of retirement, disability, dependency or other related pension benefits…”

    (la)processing is strictly necessary for the recognition, management or payment of retirement, disability, dependency or other related pension benefits, where such processing is required by contract or legal provision governing the pension plan, for the sole purpose of verifying and administering the conditions for entitlement, and is subject to appropriate and specific safeguards to protect the fundamental rights and interests of the data subject, including data minimisation, purpose limitation, restricted access and professional secrecy. This provision shall not affect the validity of other legal bases currently relied upon under this Regulation for the processing of health data related to the treatment of certain pension benefits.

    Tabled by
    Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Adina Vălean, Andrea Wechsler, Oliver Schenk, Christian Ehler
    Group
    EPP
    Targets
    GDPR Article 9 – paragraph 2 – point la (new)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point la (new)
  23. 1041 Addition Tomas Tobé +2EPP · ITRE–LIBE “processing is necessary for the purpose of scientific research by a recognised organisation that is subject to a Data Protection Impact Assessment, a…”

    (la) In Article 9, paragraph 2, the following point is inserted

    (la)processing is necessary for the purpose of scientific research by a recognised organisation that is subject to a Data Protection Impact Assessment, a recognised ethics committee, appropriate technical and organisational measures including pseudonymisation and public registration.'

    Tabled by
    Tomas Tobé, Arba Kokalari, Jörgen Warborn
    Group
    EPP
    Targets
    GDPR Article 9 – paragraph 2 – point la (new)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point la (new)
  24. 1042 Addition Angelika Niebler +1EPP · ITRE–LIBE “the processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of precontractual…”

    (la)In Article 9, paragraph 2, the following point is inserted. the other points should be adapted accordingly.

    the processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of precontractual measures taken at the data subject’s request;

    Tabled by
    Angelika Niebler, Monika Hohlmeier
    Group
    EPP
    Targets
    GDPR Article 9 – paragraph 2 – point la (new)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point la (new)
  25. 1043 Addition Aura Salla +7EPP · ITRE–LIBE “processing is necessary and proportionate for the prevention of fraud, the detection and prevention of abuse, bot and spam activity, identity misuse…”

    (lb) In Article 9, paragraph 2, the following point is added

    lb.processing is necessary and proportionate for the prevention of fraud, the detection and prevention of abuse, bot and spam activity, identity misuse, account takeover or payment fraud, or for ensuring the security of accounts, payments and transactions, provided that the processing is subject to appropriate safeguards for the rights and freedoms of the data subject.'

    Tabled by
    Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Paulo Cunha, Adina Vălean, Andrea Wechsler, Oliver Schenk, Christian Ehler
    Group
    EPP
    Targets
    GDPR Article 9 – paragraph 2 – point lb (new)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point lb (new)
  26. 1044 Addition Tomas Tobé +2EPP · ITRE–LIBE “processing is necessary for the purposes of carrying out obligations set by other Union law, without cross-references to Regulation (EU) 2016/679.'”

    (lb) in Article 9, paragraph 2, the following point is added

    lb.processing is necessary for the purposes of carrying out obligations set by other Union law, without cross-references to Regulation (EU) 2016/679.'

    Tabled by
    Tomas Tobé, Arba Kokalari, Jörgen Warborn
    Group
    EPP
    Targets
    GDPR Article 9 – paragraph 2 – point lb (new)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point lb (new)
  27. 1602 Addition Andrea Wechsler +7EPP · ITRE–LIBE “processing is strictly necessary for the anonymisation of personal data pursuant to Article 6(3a), provided that the processing is subject to…”

    In Article 9, paragraph 2 the following point k is added

    ‘(ja) processing is strictly necessary for the anonymisation of personal data pursuant to Article 6(3a), provided that the processing is subject to appropriate technical and organisational safeguards, that the data are not used to take measures or decisions concerning individual data subjects and that identifiable data are erased or rendered inaccessible as soon as they are no longer necessary for the anonymisation process.’

    Wider passage printed with the amendment

    2.Paragraph 1 shall not apply if one of the following applies:

    (a)the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

    (b)processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;

    (c)processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;

    (d)processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;(e)processing relates to personal data which are manifestly made public by the data subject;(f)processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;

    (g)processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;

    (h)processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

    (i)processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;

    Tabled by
    Andrea Wechsler, Marie-Sophie Lanig, Stefan Köhler, Alexandra Mehnert, Angelika Niebler, Verena Mertens, Christian Doleschal, Sabine Verheyen
    Group
    EPP
    Targets
    GDPR Article 9(2)(k)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 3 – paragraph 1 d (new) / Regulation (EU) 2016/679 / Article 9 – paragraph 2 – point k (new)

Paragraph 5

Added by the Commission · changed by the Council on 21 May · changed on 10 June · changed on 3 September · changed on 2 October

Parliament amendments 25

7 would delete the wording, 16 propose alternative wording and 2 would add wording to paragraph 5. Deletion amendments come from S&D, Greens/EFA, ESN and non-attached members, and from the IMCO rapporteur’s draft opinion.

By political group; co-sponsored amendments count for each group
TypeThe LeftS&DGreens/EFARenewEPPECRPfEESNNIRapporteur
− Deletion·13····111
~ Alternative1··1754·1·
+ Addition······2···

By political group

  • − Deletion S&D 1 Greens/EFA 3 ESN 1 NI 1 Rapporteur 1
  • ~ Alternative The Left 1 Renew 1 EPP 7 ECR 5 PfE 4 NI 1
  • + Addition PfE 2

Show

  1. 101 Deletion Alex Agius Saliba (rapporteur)Rapporteur · IMCO Deletes the Commission’s wording

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

    Justification

    Deletion because it would amount to a an ‘AI privilege’ difficult to meet EU principles of necessity and proportionality, affecting the overall level of the protection of consumer’s personal data.

    Rapporteur
    Alex Agius Saliba
    Group
    Rapporteur
    Targets
    GDPR Article 9(5)
    Document
    IMCO draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  2. 242 Alternative Tobiasz Bocheński +1ECR · JURI “unless such processing is strictly necessary for bias detection and correction, while adequate safeguards are in place to prevent any use of the data…”

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data, unless such processing is strictly necessary for bias detection and correction, while adequate safeguards are in place to prevent any use of the data for other purposes up to the point when the data are irreversibly anonymised or erased. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

    Tabled by
    Tobiasz Bocheński, Kosma Złotowski
    Group
    ECR
    Targets
    GDPR Article 9(5)
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5 (new)
  3. 366 Deletion David CormandGreens/EFA · IMCO Deletes the Commission’s wording

    (b) the following paragraph is added: 5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’

    Tabled by
    David Cormand on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 9(5)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9
  4. 367 Deletion David CormandGreens/EFA · IMCO Deletes the Commission’s wording

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

    Tabled by
    David Cormand on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 9(5)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9
  5. 368 Alternative Virginie JoronPfE · IMCO “These measures shall reflect the state of the art and shall include, where applicable, the filtering and removal of these data from training, testing…”

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented without undue delay to avoid the collection and otherwise processing of special categories of personal data. In order to determine whether the deletion of the data involves disproportionate effort, consideration shall be given to the state of the art, the implementation costs, the volume of data in question, the technical feasibility of isolating or extracting the data as well as the nature, scope and purposes of processing. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties. The controller shall implement effective organisational and technical measures to prevent their deduction, disclosure or use. These measures shall reflect the state of the art and shall include, where applicable, the filtering and removal of these data from training, testing and validation datasets, pseudonymisation and separation of keys as well as technical measures preventing deduction, recovery or disclosure using the outputs of the AI model or system; their application shall be proportionate to the risk and shall be documented by the controller.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 9(5)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  6. 369 Alternative Kateřina KonečnáNI · IMCO “or re-used for other purposes, in particular”

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data.When processing personal data leads to residual and incidental processing of special categories of data, the controller shall implement appropriate organisational and technical measures to avoid such processing and shall remove such data. If removal of those personal data is impossible or requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used or re-used for other purposes, in particular to produce AI outputs or actions, and, from being disclosed or otherwise made available to third parties.

    Tabled by
    Kateřina Konečná
    Group
    NI
    Targets
    GDPR Article 9(5)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5(new)
  7. 370 Alternative Arba KokalariEPP · IMCO “For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to mitigate risks…”

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoidmitigate vrisks associated with the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

    Tabled by
    Arba Kokalari
    Group
    EPP
    Targets
    GDPR Article 9(5)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  8. 371 Addition Virginie JoronPfE · IMCO “If the processing referred to in paragraph 2, point (k), is carried out in an AI regulatory sandbox set up under Article 57 of Regulation (EU)…” numbered 5a

    5a.If the processing referred to in paragraph 2, point (k), is carried out in an AI regulatory sandbox set up under Article 57 of Regulation (EU) 2024/1689, or as part of testing in real world conditions under Article 60 of this Regulation, it must comply with the conditions and safeguards provided for in Article 59 and Articles 60 and 61 of this Regulation respectively. In particular, personal data shall be processed in a functionally separate, isolated and protected environment, under the processor’s control; effective monitoring and intervention mechanisms shall be put in place to identify and mitigate any high risks to the rights and freedoms of the data subjects and, where necessary, to interrupt the processing; and all personal data shall be deleted once the participation in the sandbox or testing has terminated.;

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 9(5)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5 (new)
  9. 372 Addition Virginie JoronPfE · IMCO “Where the controller is a small or medium-sized enterprise or a small mid-cap company, the organisational and technical measures referred to in this…” numbered 5b

    5b.Where the controller is a small or medium-sized enterprise or a small mid-cap company, the organisational and technical measures referred to in this paragraph shall be implemented in a way that is appropriate to their size and their capacities, without reducing the level of protection for data subjects and, in particular, without compromising the obligation to delete or provide effective protection for particular categories of personal data. The competent authorities shall provide these enterprises and companies with guidance to this end.;

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 9(5)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5 b
  10. 1047 Deletion Mary KhanESN · ITRE–LIBE Deletes the Commission’s wording

    (b) the following paragraph shall be added: For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’

    Justification

    Specific categories of data shall not become the general data base for AI. A subsequent removal, which may be waived in the event of ‘disproportionate effort’, does not constitute effective protection.

    Tabled by
    Mary Khan
    Group
    ESN
    Targets
    GDPR Article 9(5)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
Show 15 more amendments
  1. 1048 Deletion Marina Kaljurand +8S&D · ITRE–LIBE Deletes the Commission’s wording

    (b) the following paragraph is added: 5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’

    Tabled by
    Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
    Group
    S&D
    Targets
    GDPR Article 9(5)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  2. 1049 Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the Commission’s wording

    (5) For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    GDPR Article 9(5)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  3. 1050 Deletion Markéta GregorováGreens/EFA · ITRE–LIBE Deletes the Commission’s wording

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 9(5)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  4. 1051 Alternative Irena Joveva +5Renew · ITRE–LIBE “Processing referred to in point k of paragraph 2 should exlude the processing of special categories of personal data originating from data provided…”

    5. For processing referred to in point (k) of paragraph 2, appropriatestrict organisational and technical measures shall be implemented to avoid vprevent the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation, orthe incontroller shall erase such data without undue delay prior to the completion of the training phase of the AI system or AI model. If erasure of those data from an already trained AI system or AI model proves to be technically impossible, the controller shall removefully such data. If removal of those data requires disproportionate effort,document the controllertechnological shallimpossibility, notify the competent supervisory authority, and without undue delay, and in any event, effectively protect withoutsuch unduedata delayby applying state-of-the-art filtering or aligment techniques to guarantee such data fromcannot beingbe further processed, used to produce outputs, from beingre-identified, disclosed or otherwise made available to third parties. Processing referred to in point k of paragraph 2 should exlude the processing of special categories of personal data originating from data provided by, or generated through, the activity of end users on online platforms or core platfrom services as defined in Regulation (EU) 2022/1925, irrespective of whether such processing occurs during the development, training, or operational phase of any AI system or AI model.

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 9(5)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  5. 1052 Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “In assessing whether the removal of those data requires a disproportionate effort, account shall be taken of the state of the art, the costs of…”

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data, without undue delay. In assessing whether the removal of those data requires a disproportionate effort, account shall be taken of the state of the art, the costs of implementation, the volume of data concerned, the technical feasibility of isolating or extracting the data, and the nature, scope and purposes of the processing. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requiresis disproportionatetechnically effortimpossible despite documented state-of-the-art measures, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, or re-used for AI outputs, profiling, advertising or other purposes, and from being disclosed or otherwise made available to third parties. In assessing whether the removal of those data requires a disproportionate effort, account shall be taken of the state of the art, the costs of implementation, the volume of data concerned, the technical feasibility of isolating or extracting the data, and the nature, scope and purposes of the processing; or re-used for AI outputs, profiling, advertising or other purposes,

    Justification

    A general AI derogation should not create a route for the incidental use of patient or health-related data. Health data require a specific legal basis, stronger safeguards and effective supervisory oversight. The same carve-out should be reflected in proposed Article 88c on legitimate interests for AI processing.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 9(5)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  6. 1053 Alternative João OliveiraThe Left · ITRE–LIBE “and such safeguards shall be subject to periodic verification, audit and documentation in order to demonstrate compliance with this obligation to the…”

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’In the context of the development and operation of an AI system or an AI model, the personal data controller shall implement, by design and by default, robust, appropriate and demonstrably effective organisational and technical measures to avoid the collection and any other form of processing of special categories of personal data in the datasets used for training, testing or validation, and in the AI systems and models. Where, despite the application of those measures, special categories of personal data are discovered in those sets, systems or models, the controller shall have a primary and irrevocable obligation to remove them, irrespective of the effort or cost involved, unless the controller objectively demonstrates in documented form, and under its exclusive responsibility, that the removal is materially impossible and not merely disproportionate or burdensome. In that exceptional case, and only for as long as the material impossibility of removal persists, the controller shall adopt, without undue delay, all necessary and sufficient technical and organisational safeguards to ensure, in an effective and continuous manner, that such data are not used to produce outputs, disclosed, or in any way made available to third parties, and such safeguards shall be subject to periodic verification, audit and documentation in order to demonstrate compliance with this obligation to the competent supervisory authority.’

    Tabled by
    João Oliveira
    Group
    The Left
    Targets
    GDPR Article 9(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  7. 1054 Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “The controller shall apply effective technical and organisational measures to prevent their inference, disclosure or use. Those measures shall…”

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties. The controller shall apply effective technical and organisational measures to prevent their inference, disclosure or use. Those measures shall reflect the state of the art and shall include, as appropriate, the filtering and removal of such data from training, testing and validation datasets, pseudonymisation and key separation, and technical measures preventing their inference, regurgitation or disclosure through the outputs of the AI system or model; their application shall be proportionate to the risk and shall be documented by the controller.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 9(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  8. 1055 Alternative Zala Černilec Tomašič +7EPP, ECR · ITRE–LIBE “for the purpose of training or developing an AI system or AI model. If cessation of processing”

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid vand mitigate the risk of the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controlleris notified of or identifies special categories of personal data relating to specific data subjects in the aforementioned datasets used for training, testing or validation or in the AI system or AI model, the controller shall removeimplement suchtechnically data.and Ifeconomically removalfeasible measures to cease processing of those special categories of personal data for the purpose of training or developing an AI system or AI model. If cessation of processing requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

    Justification

    This amendment makes Article 9(5) more practical by replacing the obligation to ‘avoid’ processing special categories of personal data with a proportionate duty to mitigate risks through appropriate technical and organisational measures. It clarifies that controllers must act when such data is identified or reported, and, where deletion is disproportionate, apply technically and economically feasible safeguards. The amendment preserves strong data protection while ensuring legal certainty and practical implementation.

    Tabled by
    Zala Černilec Tomašič, Jan Farský, Ondřej Krutílek, Tomáš Zdechovský, Henrik Dahl, Alexandr Vondra, Veronika Vrecionová, Lukas Mandl
    Group
    EPP, ECR
    Targets
    GDPR Article 9(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  9. 1056 Alternative Axel VossEPP · ITRE–LIBE “For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the…”

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

    Justification

    The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 9(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  10. 1057 Alternative Oliver Schenk +12EPP · ITRE–LIBE “ensure that such data are processed under one or more of the conditions referred to in paragraph 2, points a to j, or”

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented, in accordance with Article 89 safeguards to avoidlimit vthe processing of special categories of personal data and to mitigate the risk associated with the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall ensure that such data are processed under one or more of the conditions referred to in paragraph 2, points a to j, or remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’

    Tabled by
    Oliver Schenk, Axel Voss, Marie-Sophie Lanig, Ana Miguel Pedro, Romana Tomc, Marion Walsmann, Lena Düpont, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 9(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  11. 1058 Alternative Jana Nagyová +3PfE · ITRE–LIBE “for the purpose of training or developing an AI system or AI model. If cessation of processing”

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoidmitigate vthe risk of the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller is notified of or identifies special categories of personal data relating to specific data subjects in the aforementioned datasets used for training, testing or validation or in the AI system or AI model, the controller shall removeimplement suchtechnically data.and Ifeconomically removalfeasible measures to cease processing of those special categories of personal data for the purpose of training or developing an AI system or AI model. If cessation of processing requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

    Justification

    The current wording of Article 9(5), requiring controllers to ‘avoid’ the collection and processing of special categories of personal data, may be interpreted too broadly and create the expectation that controllers must eliminate such data entirely in advance. In practice, this is often not feasible, especially where large and diverse datasets are used for training and testing AI systems, and thus it could hinder AI development where appropriate safeguards are already in place. The amendment therefore replaces this overly rigid standard with a more proportionate obligation to mitigate the risk through appropriate technical and organisational measures. This approach is consistent with Article 25 - the principle of data protection by design and by default. At the same time, it preserves the duty to act where the controller is notified of, or identifies, the presence of such data - thereby covering situations in which the relevant data is brought to the controller’s attention by third parties, and not only cases of self-identification. Where cessation of processing would require disproportionate effort, the controller shall implement technically and economically feasible measures to protect the data from being used to produce outputs or otherwise made available to third parties. This standard avoids imposing obligations that are impossible to fulfil in practice and is in line with the GDPR framework.

    Tabled by
    Jana Nagyová, Ondřej Knotek, Tomáš Kubín, Jaroslav Bžoch
    Group
    PfE
    Targets
    GDPR Article 9(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  12. 1059 Alternative Krzysztof Hetman +1EPP · ITRE–LIBE “into account its capabilities, implement appropriate technical and organisational measures to cease processing that special category”

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid vmitigate the risk of collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Where, despite the implementation of such measures, the controller is notified of special categories of personal data relating to specific data subjects in the aforementioned datasets used for training, testing or validation or in the AI system or AI model, the controller shall, taking into account its capabilities, implement appropriate technical and organisational measures to cease processing that special category data for the purpose of training or developing an AI system or AI model.

    Tabled by
    Krzysztof Hetman, Adam Jarubas
    Group
    EPP
    Targets
    GDPR Article 9(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  13. 1060 Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “taking into account technical feasibility, available resources, the nature of the AI system or model, and state of the art technology”

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, taking into account technical feasibility, available resources, the nature of the AI system or model, and state of the art technology, the controller shall in any event effectivelytake protectappropriate measures proportionate to the risks posed without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

    Tabled by
    Sebastian Tynkkynen, Diego Solier
    Group
    ECR
    Targets
    GDPR Article 9(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  14. 1061 Alternative Aura Salla +6EPP · ITRE–LIBE “further processed or processed for other purposes”

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data that are incidentally and residually involved in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data without undue delay. If removal of those data requires manifestly disproportionate effort, the controller shall without undue delay and in any event, effectively protect without undue delay such data from being further processed or processed for other purposes, used to produce outputs, from being disclosed or otherwise made available to third parties.

    Tabled by
    Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Angelika Niebler, Henrik Dahl, Andrea Wechsler, Christian Ehler
    Group
    EPP
    Targets
    GDPR Article 9(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5
  15. 1062 Alternative Tomas Tobé +2EPP · ITRE–LIBE “For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to mitigate risks…”

    5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoidmitigate vrisks associated with the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

    Tabled by
    Tomas Tobé, Arba Kokalari, Jörgen Warborn
    Group
    EPP
    Targets
    GDPR Article 9(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5

Provisions only Parliament amendments would add or change

10 amendments on 5 units the Commission proposal leaves unchanged

Paragraph 1Not amended by the Commission4 proposals

  1. 241 Addition Ton Diepeveen +1PfE · JURI “Processing of personal data for the purpose of directly revealing a specific data subject’s racial or ethnic origin, political opinions, religious or…”

    (aa) A new Article 9(1) is added

    Processing of personal data for the purpose of directly revealing a specific data subject’s racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, his or her health status or sex life or sexual orientation and the processing of genetic data or of biometric data for the purpose of uniquely identifying a natural person shall be prohibited.

    Tabled by
    Ton Diepeveen, Pascale Piera
    Group
    PfE
    Targets
    GDPR Article 9 – paragraph 1
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 3 – point a a (new) / Regulation (EU) 2016/679 / Article 9 – paragraph 1 (new)
  2. 1045 Addition Oliver Schenk +11EPP · ITRE–LIBE “Processing of personal data that directly reveals in relation to a specific data subject racial or ethnic origin, political opinions, religious or…”

    (aa) Paragraph 1 of Article 9 is replaced by the following

    Processing of personal data that directly reveals in relation to a specific data subject racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health relating to the physical or mental health status of a natural person, or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

    Tabled by
    Oliver Schenk, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Andrea Wechsler, Marie-Sophie Lanig, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Romana Tomc
    Group
    EPP
    Targets
    GDPR Article 9 – paragraph 1
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a a (new) / Regulation (EU) 2016/679 / Article 9 – paragraph 1
  3. 1070 Alternative Axel VossEPP · ITRE–LIBE “The mere possibility that one of the characteristics referred to in the first subparagraph may be inferred indirectly from personal data processed…”

    3a. In Article 9, paragraph 1 is replaced by the following:

    1. Processing of personal data revealingthat is intended to directly reveal, in relation to an identified or identifiable natural person, racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, health status, sex life or sexual orientation, and the processing of genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited unless one of the conditions set out in paragraph 2 applies. The mere possibility that one of the characteristics referred to in the first subparagraph may be inferred indirectly from personal data processed for another lawful purpose shall not, in itself, render such processing subject to this Article, provided that the controller does not process the data for the purpose of revealing such characteristic."

    Justification

    The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 9 – paragraph 1
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 a (new) / Regulation (EU) 2016/679 / Article 9 – paragraph 1
  4. 1071 Alternative Tomas Tobé +2EPP · ITRE–LIBE ‘Processing of personal data directly revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union…

    "Processing of personal data directly revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited."

    Tabled by
    Tomas Tobé, Arba Kokalari, Jörgen Warborn
    Group
    EPP
    Targets
    GDPR Article 9 – paragraph 1
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 a (new) / Regulation (EU) 2016/679 / Article 9 – paragraph 1

Paragraph 2a (new)New2 proposals

  1. 1046 Addition Julie Rechagneux +8ECR, PfE · ITRE–LIBE “Points k and k under paragraph 2 shall not apply to data concerning health, genetic data, biometric data for the purpose of uniquely identifying a…”

    (aa) In Article 9, the following paragraph is inserted:

    Points k and k under paragraph 2 shall not apply to data concerning health, genetic data, biometric data for the purpose of uniquely identifying a natural person, or personal data used to infer health status, unless such processing is expressly authorised by Union or Member State law and subject to prior consultation with the competent supervisory authority.'

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 9 – paragraph 2a (new)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point a a (new) / Regulation (EU) 2016/679 / Article 9 – paragraph 2a (new)
  2. 1072 Addition Axel VossEPP · ITRE–LIBE “For the purposes of paragraph 2, point (la), important public-benefit purposes shall include in particular: (a) the protection of life, health and…”

    In Article 9, the following paragraphs are added

    For the purposes of paragraph 2, point (la), important public-benefit purposes shall include in particular:

    (a)the protection of life, health and physical integrity;

    (b)road safety, accident prevention and transport safety;

    (c)prevention of criminal offenses;

    (d)anti-discrimination and foster inclusion and participation of all persons on an equal basis;

    (e)cybersecurity, including the resilience of connected products, transport and traffic systems and critical infrastructure;

    (f)scientific research and technological development contributing to the purposes referred to in points (a) to (e).

    2b.Processing pursuant to paragraph 2, point (la), shall not be used for the purpose of identifying natural persons, monitoring individual behaviour for unrelated purposes, or taking decisions concerning identified natural persons, unless another legal basis under this Regulation applies."

    Justification

    The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 9 – paragraph 2a (new)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 b (new) / Regulation (EU) 2016/679 / Article 9 – paragraph 2a (new)

Paragraph 5a (new)New2 proposals

  1. 1063 Addition Julie Rechagneux +8ECR, PfE · ITRE–LIBE ‘Where the processing referred to in point k of paragraph 2 is carried out in the context of an AI regulatory sandbox established under Article 57 of… numbered 5a

    5a.‘Where the processing referred to in point k of paragraph 2 is carried out in the context of an AI regulatory sandbox established under Article 57 of Regulation (EU) 2024/1689, or in the context of testing in real world conditions under Article 60 of that Regulation, the processing shall comply with the conditions and safeguards laid down, respectively, in Article 59 and in Articles 60 and 61 of that Regulation. In particular, the personal data shall be processed in a functionally separate, isolated and protected environment under the control of the controller; effective monitoring and response mechanisms shall be in place to identify and mitigate high risks to the rights and freedoms of the data subjects and, where necessary, to stop the processing; and any personal data shall be deleted once the participation in the sandbox or the testing has terminated.’

    Justification

    The processing of personal data for the development of AI systems must be accompanied by robust safeguards, in particular as regards special categories of personal data. This amendment specifies the organisational and technical measures to be implemented, provides objective criteria for assessing whether the removal of inadvertently collected special categories of data would require a disproportionate effort, and subjects the removal itself to a requirement of promptness. It further establishes a graduated approach: where the processing takes place within an AI regulatory sandbox or in the course of testing in real world conditions, it must comply with the conditions and safeguards laid down, respectively, in Articles 59, 60 and 61 of Regulation (EU) 2024/1689, thereby importing the risk-control mechanisms of that Regulation — isolated processing environments, effective monitoring and response mechanisms, and deletion upon completion. Where the controller is a small or medium-sized enterprise or a small mid-cap, the measures are to be applied in a manner adapted to its capacities, without reducing the protection afforded to data subjects. This ensures coherence with the Artificial Intelligence Act while supporting innovation, in particular by smaller Union operators.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 9 – paragraph 5a (new)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5a (new)
  2. 1065 Addition Francesco TorselliECR · ITRE–LIBE ‘processing using artificial intelligence systems that involves the systematic generation of cognitive inferences concerning natural persons.’ numbered 5a

    5a.‘processing using artificial intelligence systems that involves the systematic generation of cognitive inferences concerning natural persons.’

    Tabled by
    Francesco Torselli
    Group
    ECR
    Targets
    GDPR Article 9 – paragraph 5a (new)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5a (new)

Paragraph 5b (new)New

  1. 1066 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “Where the controller is a small or medium-sized enterprise or a small mid-cap, the organisational and technical measures referred to in this…”

    5b. In Article 9, the following paragraph 5b is inserted:

    Where the controller is a small or medium-sized enterprise or a small mid-cap, the organisational and technical measures referred to in this paragraph shall be applied in a manner adapted to its size and capacities, without reducing the level of protection afforded to data subjects and, in particular, without affecting the obligation to remove or effectively protect special categories of personal data. Competent authorities shall provide such enterprises with guidance to that effect.'

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 9 – paragraph 5b (new)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 9 – paragraph 5b (new)

Paragraph 5c (new)New

  1. 1067 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “Where, in the course of web scraping from publicly accessible sources for the purposes of developing or training an artificial intelligence system or…”

    3a. In Article 9, the following paragraph 5c is inserted:

    Where, in the course of web scraping from publicly accessible sources for the purposes of developing or training an artificial intelligence system or model, special categories of personal data are collected incidentally and residually, without the controller intending to collect them, the prohibition laid down in paragraph 1 shall apply to that controller only within the framework of its responsibilities, powers and capabilities, provided that:

    (a)the processing has relevant similarities with the processing carried out by a search engine operator;

    (b)the processing of special categories of personal data is only incidental and residual, and no such processing is intentional;

    (c)it is difficult or impossible to assess, before collection, whether and to what extent the processing includes special categories of personal data; and

    (d)the controller implements measures, within the framework of its responsibilities, powers and capabilities, to prevent the collection and the dissemination of such data.

    The measures referred to in point (d) shall include, at least: defining precise criteria and applying filters to prevent collection before collection, and excluding sources structurally containing such data; deleting such data immediately after collection or as soon as identified, including upon a request by the data subject constituting a plausible indication that the data fall under paragraph 1; preventing the extraction of such data from the model and ensuring state-of-the-art resistance to privacy attacks during development; and monitoring the output of the system after development, applying output filters and, where available, model unlearning.

    The controller shall be able to demonstrate that these conditions are met and shall regularly verify the effectiveness of the measures.'

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 9 – paragraph 5c (new)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 a (new) / Regulation (EU) 2016/679 / Article 9 – paragraph 5c (new)