TL;DR
Privacy group noyb has published what it says is a leaked proposal from the Irish Council Presidency on the EU’s Digital Omnibus. The draft would treat any use of personal data “in the context of AI” as covered by a legitimate interest, removing the need for consent. noyb says many member states, including Germany, informally support it. This is a Council negotiating text, not adopted law.
What the draft would change
The provision began as Article 88c in the European Commission’s omnibus proposal and appears as Article 88bis in the Council document. As noyb reads it, companies training or using AI would be presumed to hold a legitimate interest outweighing users’ rights, whatever the purpose. That would reach people who were never customers of the company concerned, and data gathered years or decades ago on social media or in chats.
noyb argues this breaks the GDPR’s usual logic of permitting processing for defined purposes. Its example: personalised advertising without consent is unlawful today, but would become lawful if the personalisation used AI.
The group also flags two further proposals. One would narrow what counts as personal data by excluding certain pseudonymised identifiers, such as user IDs and IP addresses, from the regulation’s scope in many cases. The other would let companies refuse data subject rights they judge to be “abused”.
The politics
noyb says the Commission put the omnibus on a fast track, with no fundamental rights assessment and no direct role for the EU’s data protection expert group. Max Schrems described the plan as “digital expropriation” and warned it would chiefly benefit the companies already holding vast amounts of European data, and that data and know-how would leak out of Europe to American and Chinese firms.
The European Parliament is split. According to noyb, most of the European People’s Party favours more flexibility, the centre-left groups have resisted, and some far-right MEPs are now also opposed. noyb suggests the Court of Justice could strike down such a provision, as it previously did over data retention and EU-US data transfers.
Looking forward
For UK businesses that process EU residents’ data, the EU GDPR still applies to that processing, so this negotiation matters directly. It also sits alongside the EU’s move to delay parts of the AI Act. It raises a question UK firms rarely have to ask: whether Brussels could end up with the more permissive rules on AI training. That is a long way off: the text still faces Parliament, trilogue negotiations and possible litigation. Watch for the Council’s formal general approach.