Texts to 22 Oct 2026

Amendments as tabled

28 amendments, each tabled separately · ITRE–LIBE amendments 1053–1260 to the draft report

  1. 1064 Addition Sibylle Berg +1NI · ITRE–LIBE “Where the information referred to in Articles 13 and 14 is provided electronically, a version of that information shall be made available to the data…” numbered 1a

    (5a) the following paragraph is inserted

    1a.Where the information referred to in Articles 13 and 14 is provided electronically, a version of that information shall be made available to the data subject for download in a structured, machine-readable and commonly used file format, in addition to any other form of provision. Simply providing a link to a website, the content of which may be unilaterally altered by the controller, does not satisfy this requirement. The obligation laid down in the first sentence shall be deemed to have been fulfilled if the data subject is offered a file for download which contains the information in full, in an unaltered and permanently retrievable form.’

    Justification

    The principles developed to ensure that mandatory information is accessible to consumers need to be applied to information obligations under data protection law in order to ensure that data subjects can assert and exercise their rights, even retrospectively, for example in the event of a dispute (see recital (new)).

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 – point b / Regulation (EU) 2016/679 / Article 12 – paragraph 1a (new)
  2. 1068 Addition Pernando Barrena Arza +1The Left · ITRE–LIBE “The controller shall facilitate the exercise of data subject rights under Articles 15 to 22 of this Regulation. The controller cannot require them to…”

    3a. In Article 12, paragraph 2 is replaced by the following:

    The controller shall facilitate the exercise of data subject rights under Articles 15 to 22 of this Regulation. The controller cannot require them to exercise their rights by particular means or limit their rights by offering restrictive online tools that do not allow to request all information under Article 15(1) to (3). In any case, the controller has to provide and publicly disclose an electronic-mail address which allows data subjects to send requests electronically. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject.

    Justification

    It is up to data subjects how they exercise their rights under the GDPR. They are not bound by any form requirements. Similarly, the controller cannot require data subjects to use a particular form or medium to exercise their rights. This fact should be clarified while it should be required from controllers that they designate an email-address for data subjects who want to electronically exercise their rights. Controllers might also provide online-forms but they should still provide the alternative way of submitting an E-Mail.

    Tabled by
    Pernando Barrena Arza, João Oliveira
    Group
    The Left
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 a (new) / Regulation (EU) 2016/679 / Article 12 – paragraph 2
  3. 1069 Addition Angelika WinzigEPP · ITRE–LIBE “The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any…”

    3a. in Article 12, paragraph 3 is replaced by the following:

    The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension without undue delay and in any event within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic means, the information shall be provided by electronic means unless impossible despite the controller’s continuous efforts, unless otherwise requested by the data subject.'

    Tabled by
    Angelika Winzig
    Group
    EPP
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 3 a (new) / Regulation (EU) 2016/679 / Article 12 – paragraph 3
  4. 1074 Deletion Sibylle Berg +1NI · ITRE–LIBE Deletes the Commission’s wording

    4. In Article 12, paragraph 5 is replaced by the following: ‘5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.’

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  5. 1075 Deletion Markéta GregorováGreens/EFA · ITRE–LIBE Deletes the Commission’s wording

    4. In Article 12, paragraph 5 is replaced by the following: ‘5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.’

    Justification

    The CJEU was able to decide the ‘Brillen Rottler’ case C-526/24 on the basis of the current wording, no need to introduce new ‘abuse’ or other conditions.

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  6. 1076 Deletion Irena Joveva +5Renew · ITRE–LIBE Deletes the Commission’s wording

    4. In Article 12, paragraph 5 is replaced by the following: ‘5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.’

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  7. 1077 Deletion Birgit SippelS&D · ITRE–LIBE Deletes the Commission’s wording

    5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.

    Tabled by
    Birgit Sippel
    Group
    S&D
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  8. 1078 Alternative João OliveiraThe Left · ITRE–LIBE “Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of…”

    Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are deemed manifestly unfounded or excessive, in particular because of their repetitive character or also, forthe requestscontroller undershall Articlepropose 15 becauseto the data subject abuses the rightsfollowing conferred by this regulation for purposes other than the protection of their data, the controller may eitherscenarios:

    Tabled by
    João Oliveira
    Group
    The Left
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  9. 1079 Alternative Julie Rechagneux +7ECR, PfE · ITRE–LIBE “refuse to act on the request, and inform the data subject of the reasons thereof.”

    Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the means at their disposal to enforce the rights conferred by this regulation for purposes otherunrelated thanto the protection of their data, the controller may either:refuse to act on the request, and inform the data subject of the reasons thereof.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  10. 1080 Alternative Pernando Barrena ArzaThe Left · ITRE–LIBE “refuse to act on the request.”

    Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either:refuse to act on the request.

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2026/679 / Article 12 – paragraph 5
  11. 1081 Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “is able to demonstrate an abusive intention where”

    Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests underwhere Articlethe 15controller becauseis able to demonstrate an abusive intention where the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either:

    Tabled by
    Sebastian Tynkkynen, Diego Solier
    Group
    ECR
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5
  12. 1082 Deletion Pernando Barrena ArzaThe Left · ITRE–LIBE Deletes the Commission’s wording

    (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – point a
  13. 1083 Deletion Julie Rechagneux +7ECR, PfE · ITRE–LIBE Deletes the Commission’s wording

    (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – point a
  14. 1084 Alternative João OliveiraThe Left · ITRE–LIBE “payment of a marginal fee not exceeding the administrative costs of providing the information or communication or taking the action requested; or”

    (a) chargepayment of a reasonablemarginal fee takingnot into accountexceeding the administrative costs of providing the information or communication or taking the action requested; or

    Tabled by
    João Oliveira
    Group
    The Left
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – point a
  15. 1085 Deletion Julie Rechagneux +7ECR, PfE · ITRE–LIBE Deletes the Commission’s wording

    (b) refuse to act on the request.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – point b
  16. 1086 Deletion Pernando Barrena ArzaThe Left · ITRE–LIBE Deletes the Commission’s wording

    (b) refuse to act on the request.

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – point b
  17. 1087 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “A request may in particular be regarded as excessive within the meaning of the first subparagraph where the means at the disposal of the data subject…”

    A request may in particular be regarded as excessive within the meaning of the first subparagraph where the means at the disposal of the data subject are used for the purpose of obtaining commercially sensitive information or gaining insight into the internal processes of the controller, including for the benefit of an undertaking competing with the controller, of exerting pressure in unrelated proceedings, or of disrupting the administrative operations of the controller by imposing a manifestly disproportionate burden.

    Justification

    Specifies the circumstances in which a request may be regarded as excessive: obtaining commercially sensitive information or gaining insight into the internal processes of the controller, including for the benefit of a competing undertaking; exerting pressure in unrelated proceedings; disrupting the administrative operations of the controller by imposing a manifestly disproportionate burden. The criterion is the manifest diversion of purpose, not the mere inconvenience caused to the controller.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – second subparagraph
  18. 1088 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “The exercise of the rights conferred by this Regulation for the purpose of verifying, in good faith, whether a controller complies with this…”

    In Article 12, paragraph 5, the following subparagraph is added

    The exercise of the rights conferred by this Regulation for the purpose of verifying, in good faith, whether a controller complies with this Regulation shall not be regarded as unfounded or excessive, irrespective of whether those rights are exercised individually or with the assistance of, or through, a body referred to in Article 80.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – third subparagraph
  19. 1089 Deletion Henrik DahlEPP · ITRE–LIBE Deletes the Commission’s wording

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.

    Tabled by
    Henrik Dahl
    Group
    EPP
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – last subparagraph
  20. 1090 Deletion Tomas Tobé +2EPP · ITRE–LIBE Deletes the Commission’s wording

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.

    Tabled by
    Tomas Tobé, Arba Kokalari, Jörgen Warborn
    Group
    EPP
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – last subparagraph
  21. 1091 Deletion Niels Flemming HansenEPP · ITRE–LIBE Deletes the Commission’s wording

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.

    Tabled by
    Niels Flemming Hansen
    Group
    EPP
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – last subparagraph
  22. 1092 Deletion Alice Teodorescu MåweEPP · ITRE–LIBE Deletes the Commission’s wording

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.

    Tabled by
    Alice Teodorescu Måwe
    Group
    EPP
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – last subparagraph
  23. 1093 Alternative Pernando Barrena ArzaThe Left · ITRE–LIBE “broad in scope, concerns a long period of time, relates to complex processing operations, concerns profiling or automated decision-making, concerns…”

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request. A request shall not be considered manifestly unfounded or excessive solely because it is broad in scope, concerns a long period of time, relates to complex processing operations, concerns profiling or automated decision-making, concerns several recipients or categories of recipients, concerns possible systemic rights issues, or is made for the purpose of exercising rights under this Regulation or other rights, including consumer protection rights, employment rights, rights to non-discrimination, rights of defence, collective redress, research, journalism, regulatory oversight or civil society monitoring. The manifestly unfounded or excessive character of a request shall be assessed restrictively and on the basis of objective and documented circumstances. It shall not be inferred from the purpose of exercising rights, the use of a representative, the use of standardised requests, the scale or complexity of the processing, or the fact that compliance may require a significant effort by the controller.

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2026/679 / Article 12 – paragraph 5 – last subparagraph
  24. 1094 Alternative João OliveiraThe Left · ITRE–LIBE “effectively, in particular by lodging a complaint with the supervisory authority or by seeking a judicial remedy. The burden of proof regarding…”

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.’The data subject, when making the request, shall be presumed to be acting in the exercise of his or her legitimate interest in defending his or her rights under this Regulation. Any refusal on the grounds that the request is manifestly unfounded or excessive must be substantiated in writing, in a clear, specific and verifiable manner, indicating the objective facts and considerations supporting that conclusion. The justification must be sufficiently detailed to enable the data subject to understand the reasons for the refusal and to challenge it effectively, in particular by lodging a complaint with the supervisory authority or by seeking a judicial remedy. The burden of proof regarding whether the request is manifestly unfounded or excessive shall be on the controller.

    Tabled by
    João Oliveira
    Group
    The Left
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – last subparagraph
  25. 1095 Alternative Nadine MoranoEPP · ITRE–LIBE “of the request and the specific reasons for the request”

    The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.For the purpose of assessing whether a request is manifestly unfounded or excessive, the controller may ask the data subject to indicate the exact scope of the request and the specific reasons for the request.

    Tabled by
    Nadine Morano
    Group
    EPP
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – last subparagraph
  26. 1096 Addition François-Xavier BellamyEPP · ITRE–LIBE “The Commission may adopt implementing acts to further specify criteria for what constitutes a manifestly unfounded or excessive character of the…”

    In Article 12, paragraph 5, the following subparagraph is added

    The Commission may adopt implementing acts to further specify criteria for what constitutes a manifestly unfounded or excessive character of the request.

    Tabled by
    François-Xavier Bellamy
    Group
    EPP
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 / Regulation (EU) 2016/679 / Article 12 – paragraph 5 – last subparagraph
  27. 1097 Addition Markéta GregorováGreens/EFA · ITRE–LIBE “The Commission shall adopt delegated acts in accordance with Article 92 for the purpose of determining the information to be presented by the icons…”

    4a. Article 12, paragraph 8 is replaced by the following

    8.The Commission shall adopt delegated acts in accordance with Article 92 for the purpose of determining the information to be presented by the icons and the procedures for providing standardised icons, after consulting the Board. The Commission shall ensure that the icons cover at least the information requirements on the most common purposes and legal bases used by controllers referred to in Article 13(1)(c). Those delegated acts shall apply by [PO to insert: one year after the entry into force].'

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 a (new) / Regulation (EU) 2016/679 / Article 12 – paragraph 8
  28. 1098 Addition Angelika Niebler +1EPP · ITRE–LIBE “Where the controller is a SME, the obligations arising under this Chapter and the documentation duties connected with them shall apply in a manner…”

    4a. In Article 12, the following paragraph 8a is added:

    Where the controller is a SME, the obligations arising under this Chapter and the documentation duties connected with them shall apply in a manner proportionate to the size of the enterprise, the nature of the processing and the risk it presents for data subjects. The Board shall issue guidelines setting out simplified means of compliance for such enterprises.'

    Tabled by
    Angelika Niebler, Monika Hohlmeier
    Group
    EPP
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 4 a (new) / Regulation (EU) 2016/679 / Article 12 – paragraph 8a (new)