Article 41a

10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

Article 41a

Justification

The Commission could, by means of technical implementing acts, define entire categories of pseudonymised data as being outside the scope of the GDPR. Although pseudonymisation reduces risks, it does not eliminate the link to a person. A legal effect as fundamental as this must not be delegated to the Commission.

(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.The Commission shall be empowered to adopt guidelines specifying technical and organisational measures, including consent-management mechanisms, privacy-preserving technologies and privacy-enhancing techniques, that may be taken into account when assessing whether a controller, processor, data holder or data recipient has means reasonably likely to be used to identify a natural person and comply with its consent requesting obligations. Those guidelines shall be adopted in close cooperation with the European Data Protection Board and shall aim to promote legal certainty, interoperability and the consistent application of this Regulation across the Union. The adoption of those guidelines acts shall be without prejudice to the interpretation of Union law by the Court of Justice of the European Union, including as regards the concepts of personal data, identifiable natural person, pseudonymised data, anonymisation and means reasonably likely to be used.

(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.The Commission may adopt implementing acts to specify means and criteria to determine when data (a) is merely transitory in nature; (b) is unrelated to the data subject as an identified or identifiable natural person; (c) has appropriate technical and/or organisational safeguards to prevent any use for a purpose related to the data subject as an identified or identifiable natural person.

(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.The European Data Protection Board (EDPB) shall issue an opinion in accordance with Article 64(2) addressing the application of pseudonymisation and anonymisation, including related technical and organisational measures, to specify the means and criteria to determine whether the application of pseudonymisation and anonymisation to personal data effectively prevents the identification of a data subject and the data subject is not or is no longer identifiable.

Justification

Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.

(1) The Commission may adopt implementing acts to specify meanstechnical and organisational measures and criteria tosupporting determinecontrollers in assessing whether data resulting from anonymisation or pseudonymisation no longer constitutes personal data for certain entities and in preventing the risk of re-identification.

(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities because those entities are not reasonably likely to identify the natural person.

Justification

Generally, the comitology is strongly supported in relation to this issue. Rules of such significance should be adopted in a binding, formal and predictable way to ensure legal certainty for controllers. Soft law in form of EDPB opinion is not acceptable. This is primary concern as regards pseudonymisation; the other proposals just aim to improve on original text.

(1) The Commission may adopt implementing acts to specify the technical means and any relevant criteria to determine whether data resulting from pseudonymisation constitutes anonymized data that no longer constitutes personal data for certaina entitiesspecific entity. (Article 41 new of Regulation (EU) 2016/679)

(1) The Commission may adopt implementing acts to specify means and criteria to determine whetherwhen data resulting from pseudonymisation no longer constitutes personal data for certain entities.:

(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.The Commission may adopt implementing acts providing specifications, criteria, methodologies and practical requirements necessary to ensure the uniform application of this Regulation throughout the Union.

Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

(1) The Commission may adopt implementing acts to specify means and criteria to determine whetherwhen data resulting from pseudonymisation no longer constitutes personal data for certain entities.

(1a) In Article 41a, paragraph 1, the following subparagraphs a, b, c are added