The Commission had introduced several fundamental amendments to its text, following the EP opinion:
- As regards the approach to protection, first, it had dropped the formal distinction between the rules applying in the public sector and the rules applying in the private sector; secondly, it had expanded the provisions on the selective procedures for notification to the supervisory authority and on codes of conduct. It was thus made clearer that the protection provided must be the same whatever the sector in question.
- As regards concepts and definitions, the Commission had concurred with Parliament's wish to include the collection of data under the definition of processing of personal data. In addition, whilst the Commission had not completely eliminated the concept of a 'file', as Parliament had requested, it had clarified its meaning in order to define the scope of the directive, where processing was not automated, as covering only personal data which were entered or intended for entry in files. Lastly, a definition of the third party to whom personal data are disclosed was introduced.
- The scope had also been modified: processing carried out by non-profit-making organisations was no longer excluded, but could be the subject of exemptions from the obligation to notify; processing carried out for purposes of journalism must, rather than simply may, be subject to exemptions; processing that involved no particular danger, carried out for example to satisfy a legal obligation, could similarly be subject to an exemption from the obligation to notify.
- The provisions on protection against rules being circumvented in the course of transfers of data to non-Community countries had been strengthened.
- Lastly, the proposal had been restructured in order to take account of the dropping of the formal distinction between the public and private sectors.�