Digital Omnibus Package dated 19th Novembe

Statements in the joint opinion

Proposals rejected by EDPB and EDPS

Definition of personal data: information shall not be regarded as personal data if it does not contain elements that can reasonably be used to identify the natural person to whom it relates

The revision is considered unacceptable as it could cause uncertainty and therefore place an additional burden on data controllers in their interpretation work; furthermore, this definition does not accurately reflect the latest case law of the CJEU (the “Deloitte” case).

“The reference to the uncertainty that could arise regarding the concept of personal data is well founded in the opinion of the writers”.

Pseudonymisation of personal data, including the provision for the adoption of implementing acts by the European Commission,  by evaluating whether the available techniques are state-of-the-art and developing means and criteria to assess the risk of re-identification in relation to data subjects

In this case, the implementing act is considered incompatible with the purpose of personal data protection under the legislation and therefore unsuitable for ensuring such protection.

“Considering the comment above about the concept of personal data, the case of pseudonymisation is different, where it is believed that intervention by the Commission through an implementing act to define “means and criteria” could help data controllers when they need to understand whether pseudonymised data are personal or not.”

Proposals accepted with request of improvement by EDPB and EDPS

Definition of scientific research: any research that could also promote innovation, such as technological development

The EDPB and EDPS recommend further developing the proposed definition of scientific research, moving from recital 28 to the operative part that scientific research leads to verifiable and transparent results.

Exemption to allow the processing of biometric data: whether the processing of biometric data is necessary to confirm the identity of the data subject and whether the biometric data or the means necessary for verification are under the sole control of the data subject.

The EDPB and EDPS emphasise the importance of complying with the principles of necessity and proportionality and of using alternative methods that do not involve the processing of biometric data.

AI and legitimate interest in the processing of special categories of personal data.

In this case, it should be noted that this legal basis could already be used (Opinion 28/2024 on AI models), but it is also recommended to clarify that the right to object (Article 21 of the GDPR) should be brought to the attention of data subjects, where possible and sufficiently in advance of the processing of their personal data.

Additional exemption for incidental and residual processing of special categories of data in the context of the development and operation of an AI system or model for which a specific exemption (letter k of Article 9, paragraph 2, GDPR) to the prohibition on processing special categories of data is envisaged.

The EDPB and the EDPS recommend adding the reference to “incidental and residual” processing in the operative part, in order to ensure that the processing is only incidental and residual.

This is a fundamental clarification to ensure the correct implementation of the article.

It is also recommended to clarify the need to prevent the reuse of such data for other purposes.

Of key importance for the referral of the proposed revision of Article 4 of the AI Act: the EDPB and the EDPS recommend clarifying the interaction between the two provisions and clearly outlining the scope of Article 9(2)(k) of the GDPR, as suggested above.

Rights of data subjects for which charges may be charged or the request refused if it is manifestly excessive – repetitive in nature – or the data subjects pursue purposes other than the protection their rights.

The EDPB and the EDPS highlight the risk relating to the protection of personal data and individuals, in particular by using the term “abuse of rights” and preferring the use of “abuse of request”.

In general, there are many concerns about when a request is to be considered excessive and manifestly unfounded, suggesting that the possibility for the natural person to better specify the request should be included.

Exemption from the obligation to provide information when personal data are collected from the data subject in the context of a clear and limited relationship.

The concern highlighted relates to the concepts of “non-data-intensive activity” and “clear and limited relationship”, which cause uncertainty and ambiguity.

 We share this position, considering that the concept of “non-data-intensive activity” and of “clear and limited relationship” are often, in the real world, very subjective.

Individual automated decision-making: A decision which produces legal effects concerning an individual or similarly significantly affects him or her shall not be based solely on automated processing, including profiling, unless that decision:

a) is necessary for the conclusion or performance of a contract between the data subject and a data controller, irrespective of whether the decision can be taken by means other than those based solely on automated processing

The EDPB and the EDPS clarify the limits of the proposed revision, emphasising that it only targets the fact that a decision could theoretically also be taken by a human being, in order to prevent the controller from taking the decision by exclusively automated means.

In addition, the EDPB and the EDPS recommend amending the proposal to provide a correct interpretation so that automated decision-making is in principle permitted whenever it is available in the context of a contract, despite the use of the term “necessary”.

There therefore seems to be an opening regarding whether there may be scope for a new application of the concept of necessity in the performance of contractual measures.

“In our opinion, it would be quite useful to add also a clause, that provides for the data controller the faculty to evaluate the Legitimate Interest to base decision solely on automated processes”.

Single-entry point: in the event of a personal data breach, the data controller may proceed with notification through a single point of access, in accordance with the various regulations (NIS2 and GDPR).

The EDPB and the EDPS recommend considering a single point of access to notify data breach that takes into account all relevant legislation, such as Nis2, Dora, eIDAS, etc.