In July, I expressed some optimism about the new approach to GDPR reform in the Digital Omnibus presented by the EU Council’s Irish Presidency (GDPR reform alive again? July update) that took over from Cyprus for the second half of 2026. The Irish Presidency just succeeded in getting the EU Council to agree on a negotiating mandate, but there is little to celebrate.
The Commission’s original proposal mostly misdiagnosed where the problem with the GDPR lies (disproportionate and ideological enforcement) and despite the apparent appetite for more serious reform from some EU Member States, the Council did nothing of the kind.
The Council removed one potentially helpful institutional change (Article 41a), instead further entrenching the European Data Protection Board - the body co-responsible for the current problems. Otherwise, the Council made mostly technical changes including an answer to the Commission’s bad idea on how to tackle the cookie consent issue.
Here I just want to stress how little I now expect the GDPR Digital Omnibus to achieve and how disappointing it is to see what happened with seemingly genuine appetite for reform.
In that context, I find it strange to read the characteristically exaggerated if not outright false criticism of the Digital Omnibus from privacy advocacy groups. Yes, we’re used to that by now, but I wonder what is the point of NOYB claiming regarding the proposed Article 88c (Council’s Article 88 bis) on legitimate interest basis for AI:
Regardless of the purpose for which it is used, any AI system would be lawfully sucking up any personal data by default.
What the Commission’s proposal actually says is that personal data processing may be done for legitimate interest in an AI context where all conditions of the legitimate interest basis apply. In fact, it is actually a bit hard to see what normative novelty comes from this provision other than it serves as a reminder of what should be obvious and wasn’t even questioned on this level of generality by the EDPB.
I wonder if this rhetorical strategy is dictated by the fear that admitting that the Digital Omnibus carries very small changes would embolden proponents of reform to propose something real.
It’s also laughable how NOYB and others suddenly present themselves as the defenders of EU businesses suggesting that any rationalisation of the GDPR framework would only serve American companies. Forgetting the obvious point that, especially in an AI context, American (or Chinese) companies can develop AI using non-EU data (and thus outside the scope of the GDPR), whereas it’s the EU companies that must always apply the GDPR.
One small point that both the Commission and the Council get mostly right relates to residual and practically inevitable processing of special category (sensitive) data in AI contexts. The proposed Article 9(2)(k) addresses a serious risk that - given current GDPR enforcement attitude - could amount to a de facto prohibition on AI in the EU. The other provisions on AI in the Digital Omnibus are not as needed, though they are welcome symbolically.
For those interested in detailed analysis of where we are with GDPR reform in the Digital Omnibus, I prepared a dossier on a new subpage research.eutechreg.com. The dossier covers not only the Council negotiating texts, but also parliamentary amendments tabled.
I also recommend the new legislative tracker that allows detailed investigations into how any legal rule would change under any of the analysed legislative proposals, comparing proposals against each other (e.g., Article 9 GDPR from Council’s mandate versus the Commission’s proposal, the full history of Article 41 then 25a with all parliamentary amendments, or the whole-act view of the GDPR as would be amended on the Council mandate compared with law in force or a clean render with no redlines if you prefer), and more.