EU states back GDPR change letting AI firms use personal data, says noyb

What the Council approved

According to noyb, the Council, which represents EU Member States, approved the text on Wednesday and it was published on Thursday. The change is part of the "Digital Omnibus" proposal. The European Commission had presented that package as a set of minor changes meant to simplify things for EU companies, while promising to maintain a "high level of protection" for people in Europe, noyb says.

The provision is Article 88c in the Commission's proposal, now Article 88bis in the Council document. Under it, companies using or training an AI product would be assumed to have an overriding "legitimate interest", so no consent from users would be needed. noyb says this would also cover people who have never been customers of an AI company and data entered decades ago, for example in chats or on social media.

The Council added references to Article 21 GDPR, which provides an opt-out right in specific cases, and Article 24 GDPR, which concerns technical and organisational implementation of legal duties. noyb argues these "safeguards" would apply to any processing anyway, so in its view the new article requires no material safeguards.

noyb's criticism: a technology, not a purpose

noyb stresses that the GDPR normally permits processing for specific purposes, such as retention for tax records or fraud prevention. Article 88bis, by contrast, would legitimise an entire technology regardless of purpose. The group says this could cover AI used for manipulation, disinformation, nude image generation or killer drones.

It also argues that practices currently illegal in the EU could become legal. Personalised advertising without consent is one example: noyb says it could become lawful if it is personalised using AI. Schrems put it this way: "If something is illegal in an Excel spreadsheet, it's legal if done with an AI agent."

noyb also raises economic concerns. It says most EU companies lack the data volumes and capital of US corporations, and that data collected by EU firms but processed on platforms outside the EU could flow to providers in the US or China. The group names OpenAI, Anthropic, Google, Meta and SpaceX as companies whose interests it says would be put above data protection.

Changes to the definition of personal data

noyb also reports that Member States have proposed to narrow the definition of "personal data". Under the idea, so-called pseudonyms would regularly fall outside the GDPR. The group notes that most IT systems work primarily with pseudonyms such as user IDs, tracking IDs, IP addresses or social security numbers, and says it is unclear whether online tracking would still be covered. It adds that the decision on whether data is still personal would largely rest with the regulated companies, which it expects would lead to years of disputes.

What happens next

The Council text is not the final law. The Council must negotiate the wording with the European Parliament, which has yet to take a position, in so-called trilogues that also involve the Commission. noyb says most of the European People's Party tends to favour more loopholes in EU digital laws, while centre-left MEPs have so far pushed back and favour the status quo. It adds that far-right groups are also increasingly opposing a "free pass" for Big Tech.

The Irish Presidency currently leads the Council, and noyb notes that Ireland is the EU headquarters for most US and Chinese AI corporations. The group also points to the Court of Justice of the EU, which has struck down EU law in the past in cases involving data retention and transfers of EU data to the United States. Schrems warned that an extreme law at high risk of being overturned would create legal uncertainty instead of the promised simplification.

For now, these are the positions of a privacy advocacy group, and the final shape of the rules depends on the Parliament negotiations.