Observed Signal · Sep 21, 2026 · Policy Update · Source: Trending Topics (DACH/CEE Innovation & Tech) · Impact: 5/5 · Sentiment: Negative
Regulation Market: EU Council Proposes GDPR Loosening for AI Training
The European Commission's Digital Omnibus proposal has entered a decisive phase in the Council of the EU, with leaked documents revealing proposals to legitimize the use of personal data for AI training. The Irish Presidency compromise text introduces Article 88 bis, allowing processing for 'legitimate interests' under GDPR, while German drafting suggestions go further, proposing a statutory presumption of legitimate interest for AI training, compatibility of data reuse, and exemptions from core data subject rights. Privacy organization noyb criticizes the proposals as a 'digital expropriation' of Europeans, while the Commission frames them as simplification. The Digital Omnibus must be adopted by both the Council and Parliament, with early 2027 seen as the earliest conclusion. The proposal faces potential judicial review by the CJEU.
The EU Digital Omnibus proposal could fundamentally alter GDPR for AI training, impacting all AdTech and MarTech companies operating in Europe by allowing broader use of personal data, with major implications for privacy and consent-based advertising.
Key Takeaways & Evidence Grounding
- The European Commission's Digital Omnibus proposal includes Article 88 bis, which allows personal data processing for AI development under 'legitimate interest' under GDPR.
- German drafting suggestions propose a statutory presumption that AI training is a legitimate interest and that data reuse for AI is compatible with original purposes.
- The German proposal would exempt controllers from Articles 14, 16, 17, and 18 GDPR (information duty, rectification, erasure, restriction) under certain conditions.
- noyb founder Max Schrems calls the proposal a 'digital expropriation' of Europeans, arguing it prioritizes AI companies' interests over fundamental data protection rights.
- The European Data Protection Board and European Data Protection Supervisor raised concerns about reduced protection levels in a joint opinion.
- The Digital Omnibus must be adopted by both the Council and the European Parliament, with early 2027 as the earliest realistic date.
- The compromise text also proposes redefining personal data so that it is not personal for every entity, and allowing refusal of data subject requests in cases of 'abuse'.
Connected Companies & Entities
2 Entities mappedOntology Mapping & Concepts
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.