EU Council approves Digital Omnibus AI data use

The Council's approval comes after the European Commission chose a "fast-track procedure" for the Digital Omnibus, without carrying out a fundamental rights assessment or directly involving the European expert group on data protection. The Commission had claimed it would only make minor changes while maintaining a "high level of protection" for people in Europe. Ireland, which currently holds the Council presidency and serves as the EU headquarters for the majority of US and Chinese AI corporations, has been steering the file.

The proposed Article 88c, now Article 88bis in the Council document, departs from the GDPR's usual approach of permitting processing for specific purposes. The Council added references to existing rights and duties under Article 21 and Article 24 GDPR, but the analysis argues these alleged safeguards would apply to any processing even without that reference. Member states have also proposed narrowing the definition of "personal data" so that pseudonyms such as user IDs, tracking IDs and IP addresses would regularly not be covered by the GDPR, with companies themselves primarily deciding whether data is still personal.

Beyond the Council, the European Commission is described as having made a 180-degree turn and currently prioritising industry lobbies over fundamental rights. The European Parliament's position is still in the making, with the EPP tending to favour more loopholes while center-left MEPs have pushed back, and far-right groups increasingly opposing a "free pass" for Big Tech. The open question is whether a law without meaningful restrictions can be reconciled with EU fundamental rights, given that the European Court of Justice has struck down EU law in cases involving much less significant infringements.