EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

Article 6

Source
CJ72-AM-791072, page 136 pp. 136–150

Amendments as tabled

Nine amendments, each tabled separately · ITRE–LIBE amendments 777–1052 to the draft report

  1. 1005 Addition Bart Groothuis +6Renew · ITRE–LIBE “This is the case, when processing is necessary for the performance of a task carried out by a Member State related to national security (Article 4(2)…”

    In Article 6, paragraph 1, point e, the following sentence is added

    This is the case, when processing is necessary for the performance of a task carried out by a Member State related to national security (Article 4(2) TEU).

    Justification

    It should be made possible for Member State authorities to make use of the necessary personal and non-personal (mixed) datasets if it is used for national security purposes. This amendment is however, not intended to narrow the existing exclusion or invite GDPR oversight of national security processing.

    Tabled by
    Bart Groothuis, Ivars Ijabs, Morten Løkkegaard, Sophie Wilmès, Nikola Minchev, João Cotrim De Figueiredo, Ana Vasconcelos
    Group
    Renew
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 a (new) / Regulation (EU) 2016/679 / Article 6 – paragraph 1 – point e
  2. 1008 Addition Angelika Niebler +1EPP · ITRE–LIBE “Where the intended further processing is compatible with the purposes for which the personal data were initially collected, it may rest on the legal…”

    In Article 6, paragraph 4, the following sentence is added

    Where the intended further processing is compatible with the purposes for which the personal data were initially collected, it may rest on the legal basis that justified their collection; a separate legal basis shall not be required.

    Tabled by
    Angelika Niebler, Monika Hohlmeier
    Group
    EPP
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 b (new) / Regulation (EU) 2016/679 / Article 6 – paragraph 4 – subparagraph (new)
  3. 1011 Alternative Bart Groothuis +4Renew · ITRE–LIBE “related to military and defence purposes as mentioned”

    (2b. Article 6 paragraph 1, point e), the following point is added:

    processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;"This is the case, when processing is necessary for the performance of a task carried out by a Member State related to military and defence purposes as mentioned in Article 42 TEU."

    Justification

    It should be made possible for Member State authorities to make use of the necessary personal and non-personal (mixed) datasets if it is used for military and defence purposes.

    Tabled by
    Bart Groothuis, Ivars Ijabs, Morten Løkkegaard, Sophie Wilmès, Nikola Minchev
    Group
    Renew
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 b (new) / Regulation (EU) 2016/679 / Article 6 – paragraph 1 – point e – second sentence
  4. 1012 Alternative Axel VossEPP · ITRE–LIBE “(fa) processing is necessary for the anonymisation of personal data and that processing serves the principles of data minimisation or storage…”

    No equivalent2c. Article 6, paragraph 1, point f, including the second subparagraph, is amended as follows:

    (fa) processing is necessary for the anonymisation of personal data and that processing serves the principles of data minimisation or storage limitation. (2nd sub-paragaph) For the purposes of point f, controllers that are part of a group of undertakings within the meaning of Article 4, point 19, or institutions affiliated to a central body, shall be presumed to have a legitimate interest in transmitting personal data within that group or between such affiliated institutions for clearly defined internal administrative purposes, including central human resources management, financial and accounting administration, compliance monitoring, IT and cybersecurity management, internal audit, risk management and group reporting, provided that the processing is necessary and proportionate for those purposes and subject to appropriate technical and organisational safeguards. This presumption shall not affect the rights and freedoms of the data subject, including the right to object under Article 21, the processing of special categories of personal data under Article 9, the processing of personal data relating to criminal convictions and offences under Article 10, or the rules on transfers of personal data to third countries or international organisations under Chapter V. An illustrative list of legitimate interests within the meaning of point f of the first subparagraph is included in Annex II; the Commission is empowered to adopt delegated acts to amend Annex II by adding, deleting or modifying use-cases of legitimate interests, after having consulted the Board referred to in Article 68. Point f of the first subparagraph shall not apply to processing carried out by public authorities where they act in performance of sovereign powers."

    Justification

    The package makes Article 6 more predictable by clarifying that anonymisation may require a lawful processing step, recognising safeguarded intra-group administrative transfers, and adding a non-exhaustive Annex of legitimate-interest use cases. This supports consistent application across the Union without creating a blanket permission: necessity, proportionality and the balancing test remain required, especially for children. Commission updates after EDPB consultation keep the framework adaptable to new technologies and business practices. (see ANNEX 1a)

    Tabled by
    Axel Voss
    Group
    EPP
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 c (new) / Regulation (EU) 2016/679 / Article 6 – paragraph 1 – point f –subparagraph
  5. 1013 Addition Julie Rechagneux +8ECR, PfE · ITRE–LIBE “For the purposes of paragraph 1, the creation of a permanent user account or the provision of personal data by the data subject may be required to…” numbered 1a

    2d. In Article 6, the following paragraph 1a is inserted:

    (1a)For the purposes of paragraph 1, the creation of a permanent user account or the provision of personal data by the data subject may be required to access offers or to purchase goods or services only where strictly necessary. Where such access or purchase can be ensured without it, the controller shall offer the data subject a clear, easily accessible and non-discriminatory means to proceed, which shall not give rise to less favourable conditions for the data subject.'

    Justification

    Making access to an offer or the purchase of goods or services conditional on the creation of a permanent user account which is not necessary for the contract deprives consent of its free character, contrary to Article 7(4). The amendment requires the controller to offer a clear, easily accessible and non-discriminatory means to proceed without such an account, which may not give rise to less favourable conditions for the data subject. This is the ‘guest experience’ which the Court of Justice has already held to be required in comparable circumstances.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay
    Group
    ECR, PfE
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 d (new) / Regulation (EU) 2016/679 / Article 6 – Paragraph 1a (new)
  6. 1015 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “Processing shall be regarded as necessary for the purposes of the legitimate interests pursued within the meaning of point (f) of paragraph 1 only…”

    2e. In Article 6, the following paragraph 4a is inserted:

    Processing shall be regarded as necessary for the purposes of the legitimate interests pursued within the meaning of point (f) of paragraph 1 only where the following cumulative conditions are met:

    (a)the controller or a third party pursues a legitimate interest which is lawful, clearly and precisely articulated, and real and present rather than speculative;

    (b)the processing of personal data is necessary for that interest, and that interest cannot reasonably be achieved by other means less intrusive for the data subject, including through the use of anonymised, pseudonymised or synthetic data;

    (c)that interest is not overridden by the interests or fundamental rights and freedoms of the data subject, taking into account the nature of the data, the context of the processing, its possible consequences, and the reasonable expectations of the data subject based on their relationship with the controller.

    Where the interests or fundamental rights and freedoms of the data subject would override the interest pursued, the controller may implement technical and organisational measures to mitigate the impact of the processing on the data subject; where such measures are insufficient, the processing shall not be based on point (f) of paragraph 1.'

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 e (new) / Regulation (EU) 2016/679 / Article 6 – Paragraph 4a (new)
  7. 1016 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “Where personal data are collected from publicly accessible sources by means of web scraping for the purposes of developing or training an artificial…”

    2f. In Article 6, the following paragraph 4b is inserted:

    Where personal data are collected from publicly accessible sources by means of web scraping for the purposes of developing or training an artificial intelligence system or model, the processing may be based on point f of paragraph 1 only where the conditions set out in paragraph 1a are met. In assessing whether the interests or fundamental rights and freedoms of the data subject override the interest pursued, account shall be taken in particular of:

    (a)the nature of the data, greater weight being given to data revealing highly private information;

    (b)the context of the processing, including the volume of data, the number of data subjects and the indiscriminate character of the collection;

    (c)the consequences for the data subject, including the difficulty of exercising their rights once the model is trained;

    (d)the reasonable expectations of the data subject, having regard to the nature of the source, the publicly accessible character of the data, whether the data subject has manifestly made the data public, and any technical restriction by which the source opposes scraping.

    Consent shall not be inferred from the mere online accessibility of personal data, nor from the absence of a technical measure opposing scraping. Where the interests or fundamental rights and freedoms of the data subject would override the interest pursued, the controller may implement mitigating measures, including limiting collection to freely accessible data, excluding sources that oppose scraping, facilitating the right to object including prior to collection, and deleting or anonymising personal data as soon as possible; where such measures are insufficient, the processing shall not be based on point f of paragraph 1.'

    Justification

    Where personal data are collected from publicly accessible sources by means of web scraping for the purpose of developing or training an artificial intelligence system, reliance on legitimate interest remains subject to the conditions of Article 6(1a). The balancing test takes particular account of the nature of the data, the volume and indiscriminate character of the collection, the difficulty for the data subject of exercising their rights once the model is trained, and the reasonable expectations of the data subject, having regard to the nature of the source and to any technical restriction opposing scraping. The mere online accessibility of personal data does not constitute consent, nor does the absence of a robots.txt file. This codifies the EDPB Guidelines 03/2026.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 f (new) / Regulation (EU) 2016/679 / Article 6 – Paragraph 4b (new)
  8. 998 Addition Michael McNamara +5Renew · ITRE–LIBE “the possible consequences of the intended further processing for data subject, in particular where the data subject is a child;'”

    i) In Article 6, paragraph 4, point d is replaced by the following

    (d)the possible consequences of the intended further processing for data subject, in particular where the data subject is a child;'

    Tabled by
    Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller, Christophe Grudler
    Group
    Renew
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 – point i (new) / Regulation (EU) 2016/679 / Article 6 – paragraph 4 – point d
  9. 999 Addition Michael McNamara +5Renew · ITRE–LIBE “The processing of a child’s personal data for advertising purposes and for the creation of personality and user profiles is not permitted.”

    ii) In Article 6, paragraph 1, the following subparagraph is added

    The processing of a child’s personal data for advertising purposes and for the creation of personality and user profiles is not permitted.

    Tabled by
    Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller, Christophe Grudler
    Group
    Renew
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 – point ii (new) / Regulation (EU) 2016/679 / Article 6 – paragraph 1 – subparagraph 3