NOYB warns the EU Council is prioritising profit over fundamental rights

Digital rights advocacy organisation None of Your Business (NOYB) has strongly criticised the Council of the European Union's negotiating position on the proposed Digital Omnibus, warning that the reforms would deprioritise citizens' fundamental privacy rights in favour of technology companies' commercial interests.

NOYB argues that the Council's text would automatically deem personal data processing in the context of artificial intelligence (AI) lawful. Under proposed Article 88c (Article 88bis in the Council's document), companies would be presumed to possess an overriding legitimate interest, removing consent requirements and allowing AI systems to use vast historic archives of personal data, including information belonging to non-customers. NOYB honorary chair Max Schrems described the measure as "digital expropriation" that benefits foreign corporations such as OpenAI, Google, Meta, Anthropic, and SpaceX at the expense of European citizens.

NOYB noted that while the EU General Data Protection Regulation (GDPR) traditionally restricts processing to narrow, specified purposes, the proposed provision legitimises an entire technological category. This could inadvertently legalise controversial applications, including non-consensual personalised advertising, manipulation, or non-consensual sexual images, simply because they operate through AI systems. The group added that references to opt-out rights under Article 21 and operational duties under Article 24 GDPR offer no material new protections.

In addition, NOYB raised alarm over proposals to narrow the statutory definition of personal data through pseudonymisation exclusions, warning that excluding tracking identifiers, user IDs, and IP addresses would exempt widespread digital surveillance from GDPR compliance.

With trilogue negotiations set to begin once the European Parliament adopts its position, NOYB cautioned that an extreme deregulatory regime would face significant vulnerability before the Court of Justice of the European Union (CJEU), ultimately creating legal uncertainty rather than simplification.

Training Announcement: Find out more about our range of independent accredited qualifications from BCS and IAPP. These include professional certifications for practitioners covering data protection and AI governance, information security and risk management, along with access to public information.