Article 88c

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Justification

Europe needs a clear, harmonised lawful basis for responsible AI development and operation. Divergent interpretations of legitimate interest create uncertainty, compliance costs and incentives to train, test and validate AI outside Europe. The amendment confirms that Article 6(1)(f) may apply where processing is necessary and balanced against data-subject rights, while preserving consent requirements, the duty to choose the correct lawful basis and safeguards against disclosure of residually retained data.

Where the processing of personal data is necessary for the interests of the controller or a third party in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Justification

This amendment aligns Article 88c with the GDPR by recognising the legitimate interests of both controllers and third parties, avoiding unnecessary restrictions on AI supply chains. It removes references that could reintroduce divergent national rules on consent and an ‘unconditional right to object,’ which is already governed by Article 21 GDPR. The amendment preserves data protection while improving legal certainty, consistency, and Single Market harmonisation.

Where the processing of personal data is necessary for the interests of the controller or a third party in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Justification

Article 88c should remain fully coherent not to create new sources of legal fragmentation within the Union. While the Commission’s objective of simplification is well founded, the current wording of Article 88c does not fully achieve that aim.First, Article 6 GDPR expressly refers to the legitimate interests of both the controller and a third party. Limiting Article 88c to the interests of the controller alone would therefore introduce an unnecessary restriction and would reduce legal certainty for the development and operation of AI systems. Second, the reference to an ‘unconditional right to object’ is not aligned with the GDPR framework. The right to object is already comprehensively governed by Article 21 GDPR, which establishes the applicable conditions and limitations. Introducing an unconditional variant within Article 88c would deviate from that framework, create inconsistencies in interpretation and enforcement, and effectively render the legitimate interests ground unavailable in practice for the purposes covered by this provision.

Where the processingProcessing of personal data that is necessary for the legitimate interests ofpursued by the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or anby AIa model,third such processingparty may be pursuedcarried forout legitimate interests withinon the meaningbasis of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Such processing shall remain subject to an assessment carried out on a case-by-case basis. It shall not benefit from any presumption of lawfulness.

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject whichin requireaccordance protectionwith Articles 6 and 21 of personalthis dataRegulation, in particular where the data subject is a child.

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (The intention is to remove the words "where appropriate")

In Article 88c, the following paragraph is inserted:

In Article 88c, the following paragraph is added:

In Article 88c, the following paragraph is added:

In Article 88c, the following paragraph is added:

In Article 88c, the following paragraph is added:

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.2) Where the task or official authority of a public authority or body is laid down by Union or Member State law in accordance with Article 6(3), personal data may be further processed for the purposes referred to in paragraph 1 on the basis of Article 6(1), point (e), where: (a) the development or use of the AI system or AI model serves the performance of that task or the exercise of that official authority; (b) the purpose pursued cannot be effectively achieved by processing non-personal or anonymised data; and (c) the processing is necessary and proportionate to the public interest objective pursued. This paragraph shall not confer any new task or official authority on a public authority or body. 3) Controllers shall use non-personal or anonymised data where the purpose of the processing can reasonably and effectively be achieved by using such data.Where the use of personal data is necessary, controllers shall use pseudonymised data wherever the purpose can reasonably and effectively be achieved by using such data. 4) Processing pursuant to paragraphs 1 and 2 shall be subject to appropriate technical and organisational measures and safeguards for the rights and freedoms of data subjects. Those measures shall include, as appropriate: (a) ensuring data minimisation during the selection of data sources and throughout the training, testing, validation, deployment and operation of the AI system or AI model; (b) limiting the processing to data that are adequate, relevant and necessary for the intended purpose; (c) applying state-of-the-art privacy-enhancing technologies, including pseudonymisation, where appropriate; (d) testing, monitoring and mitigating the risks of memorisation, regurgitation, data leakage, inference and unauthorised disclosure; (e) effectively preventing personal data retained or memorised in the AI system or AI model from being used to generate outputs which disclose or otherwise make those data available to persons not authorised to receive them; (f) ensuring that personal data are included in an output only where such inclusion is necessary for the intended purpose, the recipient is authorised to receive the data and the disclosure has a legal basis under Article 6 and, where applicable, Article 9; (g) providing appropriate transparency to data subjects; and (h) facilitating the exercise of the rights of data subjects under this Regulation. 5) Where the controller cannot effectively prevent the unauthorised disclosure of personal data through the output of the AI system or AI model, the controller shall not deploy or operate that system or model in a manner that enables such disclosure. 6) The processing of special categories of personal data shall be permitted only where one of the conditions laid down in Article 9(2) is fulfilled. Where point (k) of Article 9(2) applies, the conditions and safeguards laid down in Article 9(5) shall apply. 7) Paragraphs 1 to 6 shall be without prejudice to the other provisions of this Regulation, Regulation (EU) 2024/1689 and other applicable Union or Member State law.

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model,, including measures to limit the derivation, inference, extraction or regurgitation of personal data by the system or model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data. Where the processing is carried out in the context of a high-risk AI system within the meaning of Regulation (EU) 2024/1689, or in the context of an AI regulatory sandbox or of testing in real world conditions under that Regulation, it shall comply with the conditions and safeguards laid down, respectively, in Articles 14, 59, 60 and 61 of that Regulation, which continue to apply.

Justification

The processing of personal data for the development and operation of AI systems and models must be accompanied by robust safeguards. This amendment specifies the organisational and technical measures required — data minimisation at the stage of source selection and of training and testing, protection of residually retained data against disclosure, enhanced transparency, and an unconditional right to object. It further clarifies that, where such processing is carried out in the context of a high-risk AI system, an AI regulatory sandbox or testing in real world conditions, it must comply with the conditions and safeguards laid down in Articles 14, 59, 60 and 61 of Regulation (EU) 2024/1689, which continue to apply. This ensures the coherence of the Union acquis and prevents the facilitation of data processing for AI purposes from derogating from the requirements applicable under the Artificial Intelligence Act.

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.

Justification

Europe needs a clear, harmonised lawful basis for responsible AI development and operation. Divergent interpretations of legitimate interest create uncertainty, compliance costs and incentives to train, test and validate AI outside Europe. The amendment confirms that Article 6(1)(f) may apply where processing is necessary and balanced against data-subject rights, while preserving consent requirements, the duty to choose the correct lawful basis and safeguards against disclosure of residually retained data.

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data. Where age assurance is necessary, it should rely on privacy-preserving and data-minimising techniques, and should not undermine the anonymity or confidentiality of communications.

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data. When assessing the safeguards required, account shall be taken of safeguards already provided for under Union or national law.

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of an AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data in accordance with Article 21 of Regulation (EU) 2016/679.

Justification

Article 88c should remain fully coherent not to create new sources of legal fragmentation within the Union. While the Commission’s objective of simplification is well founded, the current wording of Article 88c does not fully achieve that aim.First, Article 6 GDPR expressly refers to the legitimate interests of both the controller and a third party. Limiting Article 88c to the interests of the controller alone would therefore introduce an unnecessary restriction and would reduce legal certainty for the development and operation of AI systems. Second, the reference to an ‘unconditional right to object’ is not aligned with the GDPR framework. The right to object is already comprehensively governed by Article 21 GDPR, which establishes the applicable conditions and limitations. Introducing an unconditional variant within Article 88c would deviate from that framework, create inconsistencies in interpretation and enforcement, and effectively render the legitimate interests ground unavailable in practice for the purposes covered by this provision.

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of an AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data in accordance with Article 21 of Regulation (EU) 2016/679.

Justification

This amendment aligns Article 88c with the GDPR by recognising the legitimate interests of both controllers and third parties, avoiding unnecessary restrictions on AI supply chains. It removes references that could reintroduce divergent national rules on consent and an ‘unconditional right to object,’ which is already governed by Article 21 GDPR. The amendment preserves data protection while improving legal certainty, consistency, and Single Market harmonisation.

Any such processing shall be subject to appropriate organisational, technical and legal measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditionala right to object to the processing of their personal data.

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditionala right to object to the processing of their personal data.

In Article 88c, the following paragraph is added:

In Article 88c, the following paragraph is added:

Justification

Europe needs a clear, harmonised lawful basis for responsible AI development and operation. Divergent interpretations of legitimate interest create uncertainty, compliance costs and incentives to train, test and validate AI outside Europe. The amendment confirms that Article 6(1)(f) may apply where processing is necessary and balanced against data-subject rights, while preserving consent requirements, the duty to choose the correct lawful basis and safeguards against disclosure of residually retained data.