EU governments agree Council position weakening GDPR via Digital Omnibus
EU member states reached a Council-wide stance on the Digital Omnibus that EDRi says loosens GDPR protections for AI training data and pseudonymised data, setting up a fight with the European Parliament.
Summary
European Digital Rights (EDRi) argues in a commentary that the position EU governments agreed on 21 October 2026 on the Digital Omnibus weakens data protection. The Commission presented the Omnibus in November 2025, promising simpler digital rules without undermining fundamental rights. EDRi says the Council fixed a handful of the Commission's more dubious choices yet largely approved changes that ease use of personal data and make abuses harder to challenge. It also sees little evidence of competitiveness gains and a possible benefit to Big Tech.
On AI, EDRi objects that the Council kept a dedicated Article 88bis recognising legitimate interest as a legal basis for using personal data to develop or run AI systems. The Council states that AI development is not automatically a legitimate interest, but EDRi sees a risk of tilting the balance toward AI companies. It also criticises an exception for sensitive data appearing incidentally in AI datasets. EDRi welcomes the Council's rejection of the Commission's rewrite of the definition of personal data, though a new Article 25a could treat pseudonymised data as non-personal for recipients unable to identify individuals.
Further concerns include more room to refuse or charge for access requests, a transparency exemption for low-risk processing, a biometric verification exception, a broader reading of automated decisions as necessary for a contract, and a new definition of scientific research. On ePrivacy, EDRi welcomes keeping device-access rules there but objects to consent exemptions for audience and contextual advertising measurement and to dropping machine-readable privacy signals.
The Council also calls for a Commission report on GDPR Chapter IV within six months and a review of privacy-enhancing technologies within twelve. EDRi urges Parliament, where more than 1,800 amendments are tabled, to reject Article 25a and delete Article 88bis.