The Digital Omnibus reform now moving through the Council of the EU is the most significant renegotiation of European data protection law since the General Data Protection Regulation took effect in 2018, and it is being driven less by privacy advocates than by a competitiveness argument that has gained currency in Brussels since the start of 2026. Under the Irish presidency, which took over the Council chair in July, member states have been meeting inside the low-profile Antici Group to hammer out a compromise text, with a session held on 11 September and a fuller presidency proposal expected in the weeks that follow. The stakes are unusually high because the changes touch the definition of personal data itself, a concept that has underpinned nearly every GDPR ruling for close to a decade.
What the Digital Omnibus reform actually changes
The package put forward by the European Commission earlier this year bundles amendments to the GDPR, the ePrivacy framework, the Data Act, parts of the AI Act and elements of EU cybersecurity law into a single legislative vehicle. Its stated purpose is to cut red tape for companies, particularly smaller firms and those building artificial intelligence systems, without dismantling the substantive rights the regulation guarantees. Concretely, the current Council text would raise the threshold at which companies must notify data protection authorities of a breach, extend the deadlines for that notification, and introduce common templates for breach reports and data protection impact assessments so that compliance work is no longer duplicated across twenty seven national regimes. A new derogation would also let biometric data be processed for authentication purposes under narrower conditions than apply to other sensitive categories today.
Why the definition of personal data is the real fight
The most contested element is a proposed new Article 29a, addressing when pseudonymised information still counts as personal data. Cyprus, which held the presidency before Ireland, put forward this formulation as an alternative to the Commission’s original text, arguing it gives companies clearer rules for when anonymisation techniques take data outside the GDPR’s scope altogether. The European Data Protection Board and the European Data Protection Supervisor issued a rare joint opinion warning that the change goes far beyond a targeted or technical amendment and does not accurately reflect the case law of the Court of Justice of the EU, which has repeatedly read the definition of personal data broadly to protect individuals from re-identification. EDPB chair Anu Talus put the tension plainly, saying simplification must not come at the expense of fundamental rights.
Artificial intelligence adds a new layer of pressure
A second flashpoint concerns how the GDPR interacts with AI model training and deployment. Rather than writing a new operative legal basis, the current draft proposes a recital stating that such processing may, in appropriate cases, constitute a legitimate interest under the existing Article 6(1)(f) balancing test. Critics argue that a recital carries less legal weight than an amendment to the operative articles and could leave companies just as exposed to divergent rulings by national courts and data protection authorities as they are today. The Irish presidency has explicitly invited member states to propose further measures to facilitate compliance for organisations developing and operating AI systems, suggesting the text is still some distance from settled.
Where regulators and industry find common ground
Not every element is contentious. Both regulators and the technology sector have welcomed a push to standardise cookie consent through machine readable choice signals, an attempt to address what the EDPB and EDPS jointly called consent fatigue and the proliferation of cookie banners that has frustrated users since the GDPR’s early years. There is similar consensus around harmonising the definition of scientific research, which currently varies enough between member states to create legal uncertainty for universities and research consortia operating across borders, and around narrowing the circumstances in which data controllers can refuse or charge for manifestly excessive individual requests.
What happens next
With another Antici Group session following swiftly after the 11 September meeting, the Irish presidency intends to bring a consolidated compromise to ministers before the end of its term. The European Parliament, which has yet to formally weigh in, is expected to insist that any weakening of the personal data definition be matched by stronger enforcement elsewhere in the text, setting up a trilogue negotiation later this year or in early 2027 that will decide whether the Digital Omnibus reform ultimately marks a recalibration of European data protection or its first real retreat since 2018.
