Article 41a

(1a) In Article 41a, the following paragraph 5a is inserted:

Justification

Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.

(1b) In Article 41a, the following paragraph 5b is added:

Justification

Provides for an EDPB opinion addressing pseudonymisation and anonymisation, and determining whether their application to personal data prevents identification. Tasks the Commission with facilitating (rather than only encouraging) a code of conduct at Union level, taking the EDPB opinion into account. Then, according to existing GDPR provisions, the EDPB is empowered to provide another opinion on whether the draft code demonstrates compliance, and, if so, the Commission may give the code general validity via implementing act. This approach promotes a harmonised approach with proper oversight.

(2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.

(2) For the purpose of paragraph 1 the Commission shall:2. Implementing acts adopted under paragraph 1 may in particular:

Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

(a) assess the state of the art of available techniques;

(a) assess the state of the art of available techniques;specify criteria and methodologies for assessing whether data resulting from anonymisation or pseudonymisation can reasonably be used to identify or re-identify a natural person;

Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

(a) assess the state of the art of available techniques, including Privacy Enhancing Technologies (PET);

(a) assess the state of the art of available techniques, such as privacy-enhancing technologies;

(a) assess the state of the art of available techniques such as privacy enhancing technologies;;

(a) assess the state of the art of available techniquestechnical means;

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in practice in relation to typical recipients of data. The criteria should take into account, inter alia, the likelihood of identifying a natural person, the possibility of linking records relating to a natural person, and the potential of inferring information concerning a natural person.

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical or reasonably foreseeable recipients of data, based on costs, amount of time required, available technology, legal powers and restrictions and all other relevant objective factors.

Justification

The implementing acts should not directly determine the notion of personal data, they should include the core requirements on the means and criteria. It should be done by introducing the reason for why the data lose the status of personal data in relation to specific entities in para (1) and by adapting point 2(b) to cover the basic factors contributing to risk of re-identification (according to recital 26 GDPR). ‘or reasonably foreseeable’ is added to address risk-based determination of other than typical or intended recipients.

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data, taking into account objective factors such as cost, amount of time required, available technology, legal obligations.

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identificationdata inbeing relationused for a purpose related to typical recipients ofthe data. subject as an identified or identifiable natural person

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identificationdata inbeing relationused for a purpose related to typical recipients ofthe data subject as an identified or identifiable natural person.

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identificationdata inbeing relationused for a purpose related to typical recipients ofthe data subject as an identified or identifiable natural person.

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identificationdata inbeing relationused for a purpose related to typical recipients ofthe data. subject as an identifiable natural person

(b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data.specify methodologies for assessing risks to the rights and freedoms of natural persons;

Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

(ba) In Article 41a, paragraph 2, the following point ba is added

(ba) In Article 41a, paragraph 2, the following point ba is added

Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

(bb) In Article 41a, paragraph 2, the following point ba is added

Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

(bc) In Article 41a, paragraph 2, the following point ba is added

Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

(bd) In Article 41a, paragraph 2, the following point ba is added

Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.

(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.In the context of a group of undertakings, data resulting from pseudonymisation shall no longer constitute personal data for an undertaking where: (a) binding intra-group arrangements and appropriate technical and organisational measures, such as logical segregation and access controls, ensure that the undertaking does not have access, and is not reasonably likely to obtain access, to identification keys or additional identifying information held by another group undertaking prohibit any attempt at re-identification, and ensure that the undertaking does not possess other means reasonably likely to enable the re-identification of data subjects; and (b) the undertaking is able to demonstrate the effectiveness of such arrangements and measures.

(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.The implementation by a controller, processor, data holder or data recipient of the technical and organisational measures and criteria set out in the guidelines referred to in paragraph [1] may be relied upon as an element to demonstrate that the data are not, or are no longer, likely to lead to the re-identification of the data subjects, and that the person concerned has complied with its obligations, including its consent-requesting obligations, under this Regulation. Such reliance shall be without prejudice to the assessment of the specific circumstances of each case by the competent supervisory authority and to the interpretation of Union law by the Court of Justice of the European Union.

(3) The implementation of the meanstechnical and organisational measures and criteria outlined in an implementing act may be used as an element to demonstrate that pseudonymised data cannotdo not lead to reidentification of the data subjects in a specific case.

(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot leadbe used for any purpose related to reidentification of the data subjects as an identified or identifiable natural person.

(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot leadbe used for any purpose related to reidentification of the data subjects as an identified or identifiable natural person.

(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot leadbe used for any purpose related to reidentification of the data subjects as an identifiable natural person.

(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.Compliance with specifications, criteria or methodologies set out in implementing acts adopted under this Article may be used by controllers and processors as an element to demonstrate compliance with this Regulation.

Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

(3) The implementation of the means and criteria outlined in an implementing act may be used by an entity as an element to demonstrate that data cannot lead to reidentification of the data subjects by that entity.

(4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.

(4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion, which shall be made public, on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission.

(4) The Commission shall closely involve the EDPBEuropean Data Protection Board in the preparationspreparation of the implementing acts under this Article. The EPDBEuropean Data Protection Board shall issue an opinion on the draft implementing acts within a deadline of 8eight weeks as of the receipt of the draft fromimplementing the Commissionact.

Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.

(5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).

(5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).

(5) The Implementingimplementing Actsacts referred to in this Article shall be adopted in accordance with the examination procedure referred to in Article 93(3).

Justification

The amendment strengthens harmonised GDPR application by allowing the Commission, with close EDPB involvement, to adopt practical criteria, methodologies and specifications where fragmentation creates uncertainty. This includes anonymisation, pseudonymisation, risk assessment, codes of conduct, certification, technical measures and sectoral use cases. Such acts do not create automatic exemptions, but give controllers and processors reliable tools to demonstrate compliance, reduce over-compliance and support data-driven innovation while preserving safeguards.