EDPB and EDPS Issue Joint Opinion on Digital Omnibus
The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have issued a Joint Opinion on the Digital Omnibus Regulation proposal, which aims to simplify the EU’s digital regulatory framework, reduce administrative burdens, and improve the competitiveness of European organizations. Their analysis focuses on the GDPR, the EUDPR, the ePrivacy Directive, and the Data Acquis, evaluating whether the proposal truly simplifies compliance, increases legal certainty, and protects individuals’ fundamental rights.
The EDPB and EDPS raised serious concerns about proposed changes to the definitions of personal data in the GDPR, warning that these changes could significantly narrow the scope of data protection and create legal uncertainty. They strongly advised against allowing the European Commission to decide by implementing act what is no longer considered personal data after pseudonymisation, as this would weaken individual data protection. However, they supported certain measures such as raising the risk threshold for mandatory data breach notifications and extending notification deadlines, which would reduce administrative burdens without compromising data protection.
Regarding the ePrivacy Directive, the EDPB and EDPS welcomed efforts to address consent fatigue and simplify online privacy choices through automated and machine-readable signals. They also supported additional derogations for storing personal data in terminal equipment and encouraged a shift from behavioral to contextual advertising with appropriate safeguards. Oversight by Data Protection Authorities (DPAs) was emphasized, alongside concerns about the coexistence of different regimes for personal and non-personal data, calling for clearer rules to foster responsible innovation.
The Joint Opinion also supports integrating the Data Governance Act and Open Data Directive into the Data Act to simplify data reuse rules for public sector data. The EDPB and EDPS recommended maintaining clear legal boundaries on public sector data reuse and ensuring personal data shared during public emergencies is pseudonymised. They stressed the importance of transparency, oversight, and safeguards for data intermediation and altruism organizations. Finally, they called for streamlined enforcement provisions and empowered the European Data Innovation Board to assist in developing guidelines for consistent application of the Data Act.
