Article 9

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’In the context of the development and operation of an AI system or an AI model, the personal data controller shall implement, by design and by default, robust, appropriate and demonstrably effective organisational and technical measures to avoid the collection and any other form of processing of special categories of personal data in the datasets used for training, testing or validation, and in the AI systems and models. Where, despite the application of those measures, special categories of personal data are discovered in those sets, systems or models, the controller shall have a primary and irrevocable obligation to remove them, irrespective of the effort or cost involved, unless the controller objectively demonstrates in documented form, and under its exclusive responsibility, that the removal is materially impossible and not merely disproportionate or burdensome. In that exceptional case, and only for as long as the material impossibility of removal persists, the controller shall adopt, without undue delay, all necessary and sufficient technical and organisational safeguards to ensure, in an effective and continuous manner, that such data are not used to produce outputs, disclosed, or in any way made available to third parties, and such safeguards shall be subject to periodic verification, audit and documentation in order to demonstrate compliance with this obligation to the competent supervisory authority.’

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties. The controller shall apply effective technical and organisational measures to prevent their inference, disclosure or use. Those measures shall reflect the state of the art and shall include, as appropriate, the filtering and removal of such data from training, testing and validation datasets, pseudonymisation and key separation, and technical measures preventing their inference, regurgitation or disclosure through the outputs of the AI system or model; their application shall be proportionate to the risk and shall be documented by the controller.

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid vand mitigate the risk of the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controlleris notified of or identifies special categories of personal data relating to specific data subjects in the aforementioned datasets used for training, testing or validation or in the AI system or AI model, the controller shall removeimplement suchtechnically data.and Ifeconomically removalfeasible measures to cease processing of those special categories of personal data for the purpose of training or developing an AI system or AI model. If cessation of processing requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

Justification

This amendment makes Article 9(5) more practical by replacing the obligation to ‘avoid’ processing special categories of personal data with a proportionate duty to mitigate risks through appropriate technical and organisational measures. It clarifies that controllers must act when such data is identified or reported, and, where deletion is disproportionate, apply technically and economically feasible safeguards. The amendment preserves strong data protection while ensuring legal certainty and practical implementation.

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

Justification

The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented, in accordance with Article 89 safeguards to avoidlimit vthe processing of special categories of personal data and to mitigate the risk associated with the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall ensure that such data are processed under one or more of the conditions referred to in paragraph 2, points a to j, or remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoidmitigate vthe risk of the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller is notified of or identifies special categories of personal data relating to specific data subjects in the aforementioned datasets used for training, testing or validation or in the AI system or AI model, the controller shall removeimplement suchtechnically data.and Ifeconomically removalfeasible measures to cease processing of those special categories of personal data for the purpose of training or developing an AI system or AI model. If cessation of processing requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

Justification

The current wording of Article 9(5), requiring controllers to ‘avoid’ the collection and processing of special categories of personal data, may be interpreted too broadly and create the expectation that controllers must eliminate such data entirely in advance. In practice, this is often not feasible, especially where large and diverse datasets are used for training and testing AI systems, and thus it could hinder AI development where appropriate safeguards are already in place. The amendment therefore replaces this overly rigid standard with a more proportionate obligation to mitigate the risk through appropriate technical and organisational measures. This approach is consistent with Article 25 - the principle of data protection by design and by default. At the same time, it preserves the duty to act where the controller is notified of, or identifies, the presence of such data - thereby covering situations in which the relevant data is brought to the controller’s attention by third parties, and not only cases of self-identification. Where cessation of processing would require disproportionate effort, the controller shall implement technically and economically feasible measures to protect the data from being used to produce outputs or otherwise made available to third parties. This standard avoids imposing obligations that are impossible to fulfil in practice and is in line with the GDPR framework.

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid vmitigate the risk of collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.Where, despite the implementation of such measures, the controller is notified of special categories of personal data relating to specific data subjects in the aforementioned datasets used for training, testing or validation or in the AI system or AI model, the controller shall, taking into account its capabilities, implement appropriate technical and organisational measures to cease processing that special category data for the purpose of training or developing an AI system or AI model.

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, taking into account technical feasibility, available resources, the nature of the AI system or model, and state of the art technology, the controller shall in any event effectivelytake protectappropriate measures proportionate to the risks posed without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data that are incidentally and residually involved in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data without undue delay. If removal of those data requires manifestly disproportionate effort, the controller shall without undue delay and in any event, effectively protect without undue delay such data from being further processed or processed for other purposes, used to produce outputs, from being disclosed or otherwise made available to third parties.

5. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoidmitigate vrisks associated with the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.

Justification

The processing of personal data for the development of AI systems must be accompanied by robust safeguards, in particular as regards special categories of personal data. This amendment specifies the organisational and technical measures to be implemented, provides objective criteria for assessing whether the removal of inadvertently collected special categories of data would require a disproportionate effort, and subjects the removal itself to a requirement of promptness. It further establishes a graduated approach: where the processing takes place within an AI regulatory sandbox or in the course of testing in real world conditions, it must comply with the conditions and safeguards laid down, respectively, in Articles 59, 60 and 61 of Regulation (EU) 2024/1689, thereby importing the risk-control mechanisms of that Regulation — isolated processing environments, effective monitoring and response mechanisms, and deletion upon completion. Where the controller is a small or medium-sized enterprise or a small mid-cap, the measures are to be applied in a manner adapted to its capacities, without reducing the protection afforded to data subjects. This ensures coherence with the Artificial Intelligence Act while supporting innovation, in particular by smaller Union operators.

5b. In Article 9, the following paragraph 5b is inserted:

3a. In Article 9, the following paragraph 5c is inserted:

3a. In Article 9, paragraph 1 is replaced by the following:

1. Processing of personal data revealingthat is intended to directly reveal, in relation to an identified or identifiable natural person, racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, health status, sex life or sexual orientation, and the processing of genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited unless one of the conditions set out in paragraph 2 applies. The mere possibility that one of the characteristics referred to in the first subparagraph may be inferred indirectly from personal data processed for another lawful purpose shall not, in itself, render such processing subject to this Article, provided that the controller does not process the data for the purpose of revealing such characteristic."

Justification

The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.

"Processing of personal data directly revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited."

In Article 9, the following paragraphs are added

Justification

The amendment clarifies that Article 9 applies where data is processed to reveal sensitive attributes, not where such attributes could merely be inferred incidentally from lawful processing. This reduces uncertainty for AI, safety, mobility, cybersecurity and other public-benefit technologies using large datasets, while preserving strong safeguards. Voluntary biometric use remains allowed only with a comparable non-biometric alternative, and safeguards such as minimisation, access limits and pseudonymisation.