Article 4

1. Article 4 is amended as follows: (a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’ (32) ‘terminal equipment’ means terminal equipment as set out in Article 1(1) of Directive 2008/63/EC; (33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply; (34) ‘web browser’ means web browser as defined in Article 2(11) of Regulation (EU) 2022/1925; (35) ‘media service’ means a media service as defined in Article 2(1) of Regulation (EU) 2024/1083; (36) ‘media service provider’ means a media service provider as defined in Article 2(2) of Regulation (EU) 2024/1083;’ (37) ‘online interface’ means an online interface as defined in Article 3(m) of Regulation (EU) 2022/2065.’ (38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.’

‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’

Justification

There is a risk that the Commission’s text will narrow the scope of the concept of ‘personal data’ by linking it to a specific entity’s actual ability to identify the person, with a direct impact on the scope of Regulation (EU) 2016/679 and the fundamental right to data protection. Simplification and competitiveness are necessary, but they cannot be achieved by diminishing the protection of fundamental rights or by introducing legal uncertainty into the application of the GDPR.

‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. If, for the purposes of this paragraph, information is not classified as personal data in respect of a particular data subject, that data subject shall not, for the purposes of processing such information, have to comply with the administrative or contractual requirements laid down for the sole purpose of processing personal data under Union data protection law.’

Justification

The clarification that information should only be classified as personal data if the individual can be identified by reasonably available means primarily concerns pseudonymised data. However, this creates uncertainty for data controllers as regards their administrative requirements (e.g. agreements between the data controller and processor, safeguards for data transfers to third countries). For the sake of legal certainty, it is important to clarify that data subjects whose data is not personal in nature should not be subject to requirements relating to the processing of that data.

Information relating to a natural person is not necessarily personal data for every othera person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannotis not reasonably able to identify the natural person to whom the information relates, taking into account the means reasonably likely to be used in practice by that entity, considering all objective factors, such as the costs, technological resources and the amount of time required for identification and the safeguards applied to the processing. Such information does not become personal for that entity merely because the entity which sent the data to that entity or a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity, including objective factors such as technological resources, safeguards applied during processing, and the time necessary to complete the identification process. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest, in full compliance with the provisions of this Regulation with regard to the protection of personal data, including through the implementation of appropriate technical and organisational measures, such as pseudonymisation, where possible.’ No provision of this definition may be construed as limiting the rights of data subjects provided for in this Regulation.