EU governments call it ‘simplification,’ but their Data Omnibus deal considerably weakens our rights

The Council doubles down on the Commission’s deregulatory agenda

When the European Commission presented its Digital Omnibus in November 2025, it promised to simplify Europe’s digital rules without weakening fundamental rights. Yet, as EDRi and others warned at the time, a majority of its proposals, particularly those regarding General Data Protection Regulation (GDPR) and ePrivacy, went far beyond reducing administrative burdens. They are part and parcel of a broad deregulatory wave that is devouring most of our rights and safeguards in the name of empty promises of competitiveness and sovereignty.

On 21 October 2026, EU governments agreed on their negotiating position, which has timidly corrected some of the Commission’s most questionable choices, but has mainly endorsed changes that could make exploiting personal data easier while making abuses even harder to challenge.

The result is a deal that weakens important safeguards and makes redress harder. There is also little evidence that weakening these protections will improve Europe’s competitiveness. Some changes may instead reinforce the advantages of Big Tech companies that already control and abuse enormous volumes of information about us and the people around us.

AI companies get a helping hand to use even more personal data

One of the most worrying changes concerns the use of personal data for AI.

The Council retained a dedicated provision, Article 88bis (Article 88c in the Commission’s proposal), explicitly recognising the possibility of relying on the GDPR’s ‘legitimate interest’ legal basis to use personal data when developing or operating AI systems. Under the GDPR, companies can already use this legal basis in certain circumstances, provided they demonstrate a legitimate interest, prove that processing is necessary, and establish that people’s rights do not override that interest.

The Council clarifies that AI development does not automatically constitute a legitimate interest and that existing conditions still apply. But if legitimate interests can already justify certain AI processing, why introduce a special provision?

The concern is that Article 88bis could tilt the legitimate interest assessment in favour of AI companies, giving preferential treatment to a vaguely defined set of technologies primarily owned by autocracy-supporting billionaires, regardless of the exact purpose for which our personal data is going to be used. As recent legal analysis explains, this risks changing how the existing balancing test between legitimate interest and data protection safeguards is applied, even without formally removing its requirements.

Companies could invoke this legislative endorsement to justify extensive data reuse, even when people never reasonably expected their information to be used for AI training. And who benefits most? The same dominant Big Tech corporations that have spent decades accumulating the most intimate information about billions of people.

The Council also retains an exception for sensitive personal data appearing incidentally in AI datasets (proposed Article 9(2)(k) and 9(2)), including information revealing health, political opinions or religious beliefs. Companies must try to avoid collecting and, where collected, remove such data, but may retain them under safeguards when removal proves technically impossible or requires manifestly disproportionate effort.

These conditions might look important, but risk turning difficulties in cleaning datasets into a justification for retaining highly sensitive information. In opaque AI systems, verifying whether such data have genuinely been isolated may often be impossible. In this regard we should bear in mind that companies are mandated to protect our data and rights, and technical choices should not determine how far our fundamental rights extend.

The same data could lose protection depending on who receives them

There is some, even if limited, good news. The Council has rejected the Commission’s attempt to rewrite the GDPR’s definition of personal data in Article 4.1 and dropped its proposed Article 41a, which would have allowed the Commission to specify when certain pseudonymised information could fall outside GDPR protection – which would likely be an unconstitutional move.

However, the underlying problem remains. Under a new Article 25a, pseudonymised data, where direct identifiers have been replaced or separated, could be considered non-personal for third parties unable to identify the individuals concerned.

Consider how information travels through websites, analytics companies, cloud providers and advertising intermediaries. Each organisation possesses different information and different capacities to link, single out or identify people, and very recent history is full of examples where re-identifying individuals from large datasets has been shockingly simple (it’s been done to Netflix film rating data, NYC cab drivers data, Australian health data, many more areas). The appearance of modern re-identification methods suggests that ‘even heavily sampled anonymized datasets are unlikely to satisfy the modern standards for anonymization set forth by GDPR and seriously challenge the technical and legal adequacy of the de-identification release-and-forget model.’

The Council position includes safeguards concerning processors and onward disclosures, and recognises that identifiability depends on the circumstances. Yet its approach still focuses heavily on whether an individual recipient can identify someone, rather than fully accounting for the wider context in which data are processed, linked and shared. The Court of Justice has called for a contextual, case-by-case assessment, not a general blanket assumption that pseudonymised data fall outside the GDPR whenever one recipient cannot identify someone.

This distinction has real consequences for rights protection: organisations could claim that information is non-personal, leaving people without the transparency and access rights needed to challenge its use, and supervisory authorities could face lengthy technical investigations just to establish whether the GDPR applies, particularly across complex data chains. Instead of simplifying compliance, the Council risks creating more uncertainty for everyone involved.

Some of our rights become easier to restrict

Several other changes proposed by the Commission have been taken on by the Council.

Companies would have more room to reject or charge for access requests considered abusive. Yet access rights are often the only way to uncover unlawful surveillance, discriminatory profiling or misuse of personal information.

The Council also retains a new exemption from GDPR transparency obligations for certain limited, low-risk processing activities, such as a sports club collecting members’ contact details to manage memberships or organise activities. Where organisations have reasonable grounds to believe that people already know who is processing their personal data and why, they may be exempted from providing the information normally required under Article 13 GDPR. Although considerably narrowed, the exemption still allows organisations to assume that people already have essential information about how their personal data are processed, rather than requiring them to provide it.

The Council also introduces a new exception allowing companies to process biometric data for identity verification without explicit consent or another existing exception to processing sensitive data foreseen in the law, provided the data or means of verification remain under the person’s ‘sole control.’ While this includes safeguards, the concept of sole control remains problematic, particularly when biometric verification becomes a condition for accessing essential services. It risks normalising the collection of highly sensitive personal information instead of encouraging less intrusive alternatives.

On automated decision-making, the Council preserves Article 22’s basic protection against certain solely automated decisions. However, it also clarifies that such decisions may be considered necessary for a contract even when a human could have made them. This gives companies greater room to justify automated decisions with significant consequences, while leaving human intervention primarily as a safeguard after the wrongful decision has been made.

The Council also adds useful methodological and ethical criteria to a new definition of scientific research in Article 4(38) GDPR. Nobody denies that commercially funded research can genuinely advance scientific knowledge, and should not be excluded simply because it has commercial applications. The concern, however, is that the proposed definition, combined with easier data reuse and reduced information duties for research, could allow activities such as routine product optimisation or commercial AI development without genuine scientific objectives or sufficiently rigorous methodologies to claim privileges intended for scientific inquiry.

ePrivacy survives, but new loopholes threaten our devices and risk even more tracking

One significant improvement is the Council’s decision to keep rules protecting access to our phones, computers and connected devices within the ePrivacy Directive, rather than transferring them to the GDPR. This preserves a crucial distinction, even more so when considering the attacks against this different fundamental right from so many different angles: ePrivacy protects the confidentiality of our devices regardless of whether the information accessed qualifies as personal data.

However, the Council introduces additional exemptions allowing access without consent, including audience measurement and measurement of contextual advertising.

Contextual advertising can provide a less intrusive alternative to behavioural ad targeting. But displaying an advertisement based on a webpage’s content does not necessarily require accessing information on someone’s device. Why, then, should measuring its performance justify a new consent exemption? It is true that the Council includes restrictions on profiling and reuse, but it still permits certain device-level data collection. In addition to this, its definition of contextual advertising also covers advertising based on a single search query. A query about abortion, debt or political beliefs can reveal highly sensitive information. Using one query instead of a longer browsing history does not automatically make the practice harmless.

The Council also allows companies to ask for consent again four months after someone refuses. This may reduce repeated requests, but people will still have to keep saying no.

Worse, it deletes the Commission’s proposed system of automated, machine-readable privacy signals. That proposal offered a genuinely rights-respecting way to simplify people’s lives: allowing them to express their tracking preferences once through browsers, operating systems, apps or connected devices, and requiring services to respect those choices. Instead, parts of the industry continue demanding more exemptions from consent to get rid of cookie banners. But eliminating annoying cookie banners should not mean eliminating the right to refuse tracking.

The next deregulation exercise is already in the works

The Council has also introduced provisions that could trigger further revisions before the current negotiations have even finished.

Within six months, the Commission would have to report on GDPR Chapter IV, potentially reopening central accountability obligations for controllers and processors for discussion, particularly smaller organisations carrying out low-risk processing. It is true that smaller organisations deserve better support, but guidance, templates and better-resourced authorities can reduce compliance burdens without weakening safeguards. An organisation’s size is no reliable measure of the risks its processing creates for people.

The Council also requests a review of privacy-enhancing technologies (PETs) within twelve months, particularly regarding access to our devices. PETs can reduce risks, but technologies such as pseudonymisation do not necessarily prevent tracking, singling out, or harmful data reuse. Other references to PETs throughout the text raise similar concerns about using technical measures to justify narrower legal protections. One thing that was central to the essence of GDPR is that technical safeguards should help organisations meet their obligations, rather than become arguments for removing them.

The European Parliament must change course

The European Data Protection Board and European Data Protection Supervisor – all EU’s data protection watchdogs – have already warned that parts of the Digital Omnibus could reduce protection and increase legal uncertainty.

The Council has corrected some important problems, particularly concerning ePrivacy and the definition of personal data. But its position still makes extensive data reuse easier, weakens safeguards, and introduces legal exceptions that will generate further uncertainty.

The European Parliament must now address these problems. This means rejecting Article 25a’s approach to pseudonymised data, deleting the AI-specific Article 88bis and the new exception for sensitive data in Article 9(2)(k), and preserving meaningful safeguards for access, transparency and automated decision-making.

MEPs should also resist further consent exemptions under ePrivacy and restore legally binding, machine-readable privacy signals that allow people to refuse tracking without confronting endless cookie banners. With more than 1,800 amendments tabled, Parliament has an opportunity to prioritise genuine simplification that makes compliance easier for smaller organisations and rights easier to exercise and enforce.

Meanwhile, the promised competitiveness gains remain speculative. Giving companies that already control vast amounts of data more flexibility will hardly solve the EU’s dependence on dominant technology providers. The EU can simplify its digital rules without weakening fundamental rights. And if its competitiveness strategy increasingly depends on doing the latter, perhaps it is the strategy, rather than our rights, that needs reconsidering.