EU Countries Agree on GDPR and Digital Omnibus Position
EU member states have agreed on a negotiating position for the proposed Digital Omnibus, a package designed to simplify parts of the EU’s digital regulatory framework. The package covers changes to the General Data Protection Regulation (GDPR), the ePrivacy Directive, and cybersecurity incident reporting rules. The agreement allows the Council of the EU to begin negotiations with the European Parliament once Parliament adopts its own position.
A key point in the Council’s agreement is the decision to retain the GDPR’s current definition of personal data. Member states rejected a proposed amendment that could have meant information was not considered personal data simply because a particular organization could not identify the individual concerned. Data protection authorities had warned that this approach could narrow the scope of the GDPR and weaken safeguards for pseudonymized information.
The Council also supports clearer rules on pseudonymization and data processing. Its position includes additional safeguards for the use of sensitive personal data in biometric verification and artificial intelligence training. It also calls for clarification of the legal grounds for processing personal data and the safeguards required when personal data is used to train AI systems.
The proposed changes to the ePrivacy Directive aim to reduce unnecessary cookie consent requests. Consent would not be required in certain situations, including where cookies are necessary to provide a service, measure audiences, or protect the security of a user’s device. The changes are intended to reduce cookie banner fatigue while maintaining privacy protections for individuals.
The Council’s position also addresses cybersecurity incident reporting. Unlike the European Commission’s proposal for a single EU-level reporting portal, member states favor national reporting portals that reflect differences in national laws and procedures. At the same time, the Council supports a more harmonized framework for incident notifications, including rules for reporting incidents that affect more than one EU country.
Irish ministers said the agreement supports the goal of simplifying digital rules, reducing compliance costs, and improving Europe’s competitiveness. However, the final outcome will depend on negotiations between the Council and Parliament. Businesses should therefore monitor the legislative process closely, particularly in relation to GDPR definitions, pseudonymization, AI training data, cookies, and cybersecurity reporting.
