Artificial Intelligence & Machine Learning
,
General Data Protection Regulation (GDPR)
,
Next-Generation Technologies & Secure Development
Council of the EU Rejects Redefinition of ‘Personal Data’
A rejection by European Union member governments of proposal backed by the European Commission to make it easier to share data about individuals won cautious plaudits from Paul Nemitz, a key architect of Europe’s General Data Protection Regulation.
See Also: OnDemand | Fireside Chat: Staying Secure and Compliant Alongside AI Innovation
As part of a legislation meant to boost economic competitiveness, Europe’s executive branch proposed in late 2025 “Digital Omnibus” bill that would streamline tech laws, including the GDPR. Among the Commission’s proposals was a redefinition of “personal data” in a way that would make it easier to collect and process people’s information. European data protection regulators weighed in earlier this month against the amendment (see: EU Privacy Watchdogs Pan Digital Omnibus).
The Council of the EU, which directly represents bloc member governments in the legislation process, rejected the Commission’s proposed redefinition of personal data. As first reported by Euractive Friday, the Council’s proposed compromise text does not include the redefinition.
“It is a good development if the council does not accept any change to the definition of personal data under GDPR, as already advised by the European Data Protection Board,” Nemitz, once the Commission’s lead director for establishing the GDPR, told Information Security Media Group on Tuesday.
The commission had proposed removing the “personal data” classification for data about a person that a company collects and processes without being able to immediately connect it with the identifiable individual, even if that company then sells the data to an ad-tech firm that can make the connection. The watchdogs said the idea risked “significantly weakening individual data protection.”
While he applauded the Council’s deletion of this change, Nemitz does not entirely favor its proposed Digital Omnibus compromise.
The council’s proposed text cuts out an article that would have given the Commission the power to use secondary legislation known as implementing acts to “specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.” But it also proposes a recital that still accepts the possibility of sufficiently pseudonymized data losing the “personal” classification.
Nemitz argued that this contradicts the GDPR’s “very clear” wording, saying: “All pseudonymized data is personal data; only anonymized data is not personal data anymore.”
Member states should also reject a proposed change that would by default allow artificial intelligence companies to claim “legitimate interests” as a valid legal basis under the GDPR for training their models on people’s information, said Nemitz, currently a visiting professor of law at the College of Europe in Bruges. Regulatory and judicial decisions have already given this tactic the all-clear, but the commission is nonetheless trying to codify it in law.
“AI Is constantly learning and training itself, thus such a wording would be a free for all, mostly benefitting U.S. and Chinese social networks and chatbots who target people based on very detailed profiles consisting of huge personal data collections,” Nemitz said. “What people tell AI chatbots is much more sensitive and detailed personal data than anything else we find on the internet. To allow explicitly these collections of human interests, desires, doubts, sexual, political or religious orientations to exist and be used for training AI means opening up the road to manipulative anthropomorphic, thus human-like AI, and would be the end of human self-determination and democracy as we know it.”
“What AI development in Europe now requires is not the watering down of protection of humans already existing in [the] GDPR, but legal certainty that these protections are enforced with rigor and thus it is [worthwhile] to invest in AI in Europe which supports democracy, individual self-determination and fundamental individual rights rather than exploitative target advertising models which we now see are being developed by OpenAI for ChatGPT and others, while employees leave OpenAI in protest,” Nemitz added.
The Commission had not responded to a request for comment about the Council’s compromise text at the time of publication nor had the members of the European Parliament who are steering their institution’s evaluation of the proposals.
Parliament is yet to present its stance on the Digital Omnibus, but on Tuesday it published a study finding the Digital Omnibus “may weaken uniform protection.” The Commission’s limited consultation and failure to conduct a full impact assessment “undermine transparency, democratic accountability and legislators’ ability to assess who benefits or loses from the reforms.”