Article 41a

10. The following article is added: ‘Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’

(1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.The Commission shall be authorised to adopt guidelines specifying technical and organisational measures, including consent management mechanisms, privacy-preserving technologies and privacy-strengthening methods, which may be taken into account to determine whether a processor, a subcontractor, a data holder or a data recipient has means which are reasonably likely to be used to identify a natural person and to fulfil the obligations relating to a request for consent. These guidelines shall be adopted in close cooperation with the European Data Protection Board and shall be aimed at improving legal certainty, interoperability and the consistent application of this Regulation throughout the Union. The adoption of these guidelines shall be without prejudice to the interpretation of Union law by the Court of Justice of the European Union, including as regards the notions of personal data, identifiable natural person, pseudonymised data, anonymisation and means reasonably likely to be used.

(a) assess the state of the art of available techniques, such as privacy enhancing technologies;

(3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects.The implementation, by a processor, a subcontractor, a data holder or a data recipient, of technical and organisational measures and criteria set out in the guidelines referred to in paragraph [1] may be referred to as an element which makes it possible to demonstrate that data are not, or are no longer, likely to allow the reidentification of the data subjects, and that the data subject has fulfilled his or her obligations, including those relating to the request for consent, under this Regulation. Consideration of these elements shall not affect the assessment of specific circumstances on a case-by-case basis by the competent supervisory authority or the interpretation of Union law by the Court of Justice of the European Union.

(3) The implementation ofWhere the means and criteria outlined in an implementing act mayare implemented, the data shall be usedpresumed as an elementnot to demonstrate that data cannot lead to the reidentification of the data subjects.

Justification

Turns advanced privacy-enhancing technologies into a rebuttable presumption of compliance, giving legal certainty and rewarding investment in privacy technology instead of paperwork.

(5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).’