EU corrects its GDPR shortly before the deadline
The EU GDPR, which comes into force on May 25, is currently driving many companies crazy. Before the deadline, the EU Council published a corrigendum. It contains a small but not entirely trivial change.

It is not unusual that in the final editing of extensive works of law there are still one or two things that need to be clarified. That is why the publication of a 386-page Supplement and clarification on the General Data Protection Regulation no surprise. In addition to various "normal" corrections, such as corrected page references, clarification of ambiguous formulations and the like, there is also a passage in the new version that - from a legal point of view - changes the situation. Article 25, Paragraph 2, Sentence 1 originally stated: "The responsible party shall take appropriate technical and organizational measures to ensure that, through default settings basically only personal data whose processing is necessary for the specific processing purpose in question are processed". In the revised version, the word "in principle" is now missing. The key point: "In principle" in case law means that there are also exceptions that may deviate from a principle.
Specifically, the new wording without "in principle" means the following: Anyone who sends customer e-mails or newsletters only needs an e-mail address for this purpose. For an individual salutation such as "Dear Mr. ..." or "Dear Ms. ...", personal data such as surname and first name is required. This would have just been permissible in the original wording. However, the new wording now goes so far that in future only the e-mail address itself may be requested. In the original version, other data could have been requested on a voluntary basis. The omitted "in principle" now also causes operators of e-commerce platforms in Switzerland, but also other companies that want to regularly contact customers in the EU by email, additional work in the adaptation of contact forms, etc. The short-term change of the GDPR is grist to the mill of all those who criticize the increasing regulatory pressure - not only from the EU - not to mention additional legal fodder...
More information including a link to an EU GDPR guide is available in this article.