GDPR reform alive again? July update
Last month, I argued that the Digital Omnibus risked giving even more control over the GDPR to privacy regulators whose interpretations created our current problems (EU Digital Omnibus Hands the Wheel to the Referee). However, it looks like an influential group of EU national governments is pushing for a more sensible direction. Procedurally, such a change of direction is enabled by the new Irish Presidency of the EU Council, which took over from Cyprus for the second half of the year. Instead of re-using the bad draft prepared by Cyprus, Ireland reopened substantive discussions over the Commission’s Proposal on key points like pseudonymisation, cookie consent, and AI processing.
That said, early indications from the European Parliament suggest that any serious reform ambitions will face obstacles there. Its joint ITRE–LIBE draft report leaves the Commission’s most contested GDPR proposals in place for now, but the co-rapporteurs’ public positions and the large volume of subsequently tabled amendments show how unsettled the file remains.
There is also relevant news from the data-protection authorities, which don’t formally legislate, but who have been very influential with some national governments. The European Data Protection Board published its Guidelines on the distinction between personal and anonymous data, finally accepting in principle the chief substantive point of the Commission’s proposal (the entity-relative view). However, the EDPB Guidelines also show why a procedural reform is the most urgent: as usual, the EDPB could not bring itself to provide guidance that is practically useful for anything other than increasing lawyers’ billable hours.
Procedural moves since June
The Council (national governments). The Cyprus Presidency of the EU Council tried to get the EU national governments to agree on a common legislative position that would have made the GDPR situation even worse than having no reform at all. A week before the end of its Council role, Cyprus delivered another compromise draft following the one I commented on previously. However, Cyprus did not succeed as several governments objected to the approach (this group reportedly included Denmark, Germany, Italy, Poland, and Sweden, among others). We don’t know for certain what the reason was for this, but reports suggest that it was due to insufficient simplification ambitions. If that’s the case, then we may still have some hope for this reform process. The new Irish Presidency decided not to carry over the draft text prepared by Cyprus. Instead, they circulated a questionnaire to other national governments to revisit cookie exemptions, pseudonymisation, AI data processing, and reductions in compliance burdens.
The Parliament. On the EU Parliament side, the parliamentarians in charge of leading the legislative negotiations published their draft report in late June. This report will be considered by the two committees that share the lead responsibility for this legislative file: the Committee on Industry, Research and Energy (ITRE; rapporteur Aura Salla of the European People’s Party), and the Committee on Civil Liberties, Justice and Home Affairs (LIBE; rapporteur Marina Kaljurand of the Socialists and Democrats). (Two other committees, JURI and IMCO, have opinion competence, and we have drafts of their opinions). This joint ITRE-LIBE draft report should be treated as an expression of what Salla and Kaljurand were able to agree on relatively quickly, which is why it does not touch hot issues like the Commission’s proposed clarification of the definition of “personal data.” How much debate there is going to be is illustrated by the large volume of amendments proposed aside from the ITRE-LIBE report. Notably, both Salla and Kaljurand suggested they will push for amendments on issues left alone in the draft report (like the definition of personal data).
EDPB’s guidelines on anonymization and personal data. The European Data Protection Board published new Guidelines on anonymisation, which are directly relevant to the Commission’s Proposal. The EDPB finally admitted in that document that whether information should be treated as anonymous (and thus not as personal data) depends on the situation of the entity processing the information (the entity-relative view). This is broadly what the Commission wants to clarify in Article 4 GDPR, which contains the definition of personal data. However, the EDPB Guidelines surround the core point with more far-reaching and less concrete qualifications than what the Commission would likely have done. I’ll come back to this in a moment.
The “AI Omnibus” entered into force. Meanwhile, a much less controversial sister Digital Omnibus proposal, touching the EU AI Act, entered into force this week. The “AI Omnibus” postponed some compliance dates, added a new prohibition on AI-generated child sexual-abuse material and non-consensual intimate imagery, and extended the legal basis for using sensitive personal data to detect bias in AI systems.
Where are we with substantive issues?
The GDPR’s scope: the effort to clarify the definition of “personal data” may fail, but that’s a symbolic issue. From what’s been reported about the last weeks of inter-governmental negotiations under the Cyprus Presidency, it looks like there is a significant opposition in the EU Council to the Commission-proposed clarification of the definition of personal data in Article 4 GDPR. This aspect of the Proposal is also facing opposition in the Parliament. Even though I’ve been supporting the proposed clarification, I continue to stress that its significance is mostly symbolic, especially since the EDPB also officially accepted the core principle (the entity-relative view) in their Guidelines on anonymisation.
Some will argue that even if it may be acceptable to clarify the definition, this needs to come with more qualifications - along the lines of what the Guidelines say. Or even that, given that the EDPB said they accept the entity-relative view, no change in Article 4 is needed.
Whereas, I would point out that the Guidelines - characteristically for the EDPB - provide very little clarity and almost look designed to be operationally difficult to implement (other than by assuming everything is always personal data). Which is why the most important changes proposed by the Commission are those that give it, not the EDPB, powers to make implementing acts, helping to define key concepts like pseudonymisation and personal data. If anything, those powers should be strengthened to be capable of providing strong legal presumptions of compliance. Notably, the Commission’s Proposal makes compliance with a Commission implementing act only “an element” in analysis, not a robust legal presumption.
We need practical guidance with legal force. What really matters is whether there will be more detailed guidance allowing anyone processing EU data to determine what concrete measures remove them from the scope of the GDPR (i.e., that they are not processing personal data). The EDPB, in its Guidelines on anonymisation, once more proved that it is institutionally incapable of delivering such guidance.
Beyond the substance of such as-yet-nonexistent guidance, it is also crucial for it to be capable of creating strong legal presumptions that following the guidance constitutes lawful behaviour. One amendment going in that direction has been proposed in Parliament by a Polish MEP, Piotr Müller (Amendment 398). The ITRE-LIBE rapporteurs’ draft report doesn’t yet change the relevant provision (Article 41a), but the general tenor of that report, as well as many of the parliamentary amendments tabled, goes in the opposite direction: to preserve or even strengthen the role of the EDPB.
Cookies and browser-level consent. The weakest part of the Commission’s Proposal related to the cookie-consent law (Article 5 of the ePrivacy Directive) has understandably been unpopular with the national governments to the extent that the Cyprus Presidency reportedly dropped it from its last draft. The Irish Presidency reopened this at least partially, reportedly asking about a possible expanded whitelist of activities that would not require consent (it’s not clear whether they asked about browser-level consent). The ITRE-LIBE rapporteurs’ draft report left this part of the Proposal intact. The amendments tabled by other MEPs cover the spectrum of possible options on the ePrivacy consent requirement: from simply applying default GDPR rules instead, to adding more listed exemptions, to restricting the scope of exemptions. Similarly, regarding the Proposal’s browser-level consent, MEPs diverge between deleting the idea and expanding its scope of application.
AI provisions. The Proposal’s two provisions most relevant to AI are its Article 88c (clarification that GDPR provides a legitimate-interest basis for AI development and operation) and Article 9(2)(k) (a derogation for special-category data that appears incidentally in AI training). In my early June comments, I reported that in the Council draft texts “Article 88c has disappeared from the operative text, but much of its substance survives in Recital 33a” whereas “Article 9(2)(k) survived, albeit in narrowed form.” Under the Irish Presidency, it looks like those issues are also open. Like with the cookie-consent provisions, the ITRE-LIBE rapporteurs’ draft report did not suggest changes to this aspect of the Proposal. Other tabled amendments diverge between deleting the AI provisions and expanding them.
I’m watching the issue of a derogation for special-category data that appears incidentally in AI training (i.e., Article 9(2)(k)) especially closely, as I think it may be the most directly consequential positive change proposed by the Commission. As I wrote in the March ICLE Comments:
Article 9(2)(k) addresses a practical constraint of large-scale AI training: special categories of personal data will inevitably appear in training datasets despite efforts to exclude them. … Perfect ex ante filtering is technically impossible. … Without Article 9(2)(k), controllers face a binary choice: guarantee perfect exclusion of special-category data or abandon AI training in the EU.
What happens next?
On the Parliament side, the deadline for tabling amendments passed on 15 July, with more thatn a thousand amendments submitted. The first ITRE-LIBE draft report is far from settling the Parliament’s overall position. The lead rapporteurs will work through the autumn on negotiating compromise amendments, while also waiting on a targeted impact assessment. The way things look now, Parliament’s negotiating position seems unlikely before February 2027. Meanwhile, the EDPB’s consultation on its anonymisation guidelines closes on 30 October.
In the Council, we’ll see if Ireland can achieve during in its six-month Presidency what Cyprus could not: an agreed negotiating position. We don’t know how Ireland plans to structure its work once it receives questionnaire responses from other governments. The next Council Presidency compromise text should tell us much more.