EU Council agrees negotiating position on Digital Omnibus for data

The Irish Presidency of the Council of the European Union has announced that Member States have agreed on a negotiating position for the proposed Digital Omnibus, which aims to update and simplify certain rules on data protection, privacy and cybersecurity. 

The package introduces key amendments to the EU General Data Protection Regulation (GDPR). While retaining the existing definition of personal data, the text introduces a new pseudonymisation provision, as well as simplifying rules on unfounded or excessive requests and low-risk information obligations. In addition, the text introduces a principle-based definition for scientific research with targeted exemptions for research organisations. To support innovation, the mandate sets safeguards that allow the processing of sensitive data for biometric verification and artificial intelligence (AI) development. The Council also backed extending the deadline for notifying personal data breaches, creating common compliance templates, and establishing an EU-wide list of high-risk processing activities.

Under the e-Privacy Directive, the Council's negotiating position updates cookie rules by expanding specific consent exemptions, such as for direct service provision, audience measurement, and device security. By streamlining the number of categories of processing where consent is required, the Council aims to reduce the number of consent banners users encounter.

On incident reporting, the Council proposes replacing a single EU-wide system with designated national entry points in each member state, complemented by an EU-level information point and a harmonised framework for incident notifications.

The Council's next step will be to begin negotiations with the European Parliament as soon as it adopts its negotiating position.

In related news, an op-ed in European Law Blog by AI, Vrije Universiteit Brussel PhD candidate Pablo Trigo Kramcsák discusses how a clause inserted into Article 6 would fundamentally change the legitimate interest test for AI training and development.

Training Announcement: Find out more about our range of independent accredited qualifications from BCS and IAPP. These include professional certifications for practitioners covering data protection and AI governance, information security and risk management, along with access to public information.