Schrems criticises leaked Digital Omnibus plans creating AI training free pass

A blog article by the Austrian privacy and digital rights advocacy group NOYB has criticised leaked proposals by the Irish Presidency of the Council of the European Union, warning that they would allow the commercial interests of artificial intelligence (AI) companies to override fundamental data protection rights.

Under the proposals, which form part of the Digital Omnibus, personal data processing conducted in the context of AI would be deemed automatically lawful. Technology companies including OpenAI, Anthropic, Google, Meta, and SpaceX would be permitted to process current and historic personal data without obtaining user consent, establishing a default overriding legitimate interest for model training and deployment. NOYB honorary Chair Max Schrems described the measure as "digital expropriation".

The draft changes to EU General Data Protection Regulation (GDPR) Article 88c (designated as Article 88bis in the Council document) were introduced via a fast-track procedure without a fundamental rights assessment or formal consultation with European data protection expert groups. NOYB argues that the provisions legitimise processing for any controversial purpose, including disinformation, autonomous weapons, and the previously unlawful practice of non-consensual targeted advertising.

Member states have also proposed narrowing the definition of personal data under the GDPR by excluding pseudonymous identifiers, such as user or tracking IDs and internet protocol (IP) addresses. Furthermore, companies would be permitted to assess whether the GDPR applies based on their internal technical capabilities, and data subject rights should not apply where they are abused by data subjects. 

NOYB clarifies that the situation is less dire in the European Parliament, where some MEPs have resisted the measures. 

Max Schrems warns, however, that "if the legislator has lost all sense of proportion and direction, then the people can only turn to the courts. Any extreme law that has a high risk of being overturned would at the same time only create more legal uncertainty."  In the context of the Digital Omnibus, this is hardly the type of simplification the Commission intended when it launched its "ambitious program" to strengthen EU competitiveness. 

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.