Proposed GDPR Revisions Stokes Privacy Concerns

More than 100 privacy rights groups and experts urged the European Commission to retreat from proposals to revise the General Data Protection Regulation that the commission has touted as part of a continental effort to cut red tape.

See Also: How Enterprise Browsers Enhance Security and Efficiency

In a letter to EU digital policy chief Henna Virkkunen and Michael McGrath, commissioner for democracy and justice, 108 civil society organizations and academics requested the commission to “reject any reopening of the GDPR,” and ensure that the regulation continues to be the cornerstone of the “EU’s digital rulebook.”

Europe has pledged to lessen record-keeping obligations for companies with up to 500 employees so long as the data processing isn’t “likely to result in a high risk” to rights and freedoms. “We will be examining what ways in which we can ease the burden on smaller organizations in relation to the retention of records while at the same time preserving the underlying core objective of our GDPR regime,” McGrath said during a March 13 speech in Washington, D.C.

The European Data Protection Board gave the proposal a tentative endorsement earlier this month.

Signatories of the letter say a diminishing record keeping obligations “could instead roll back key accountability safeguards and with them, the accountability principle itself.”

The GDPR is the EU’s flagship privacy regulation, in force since 2018. It spells out privacy measures that companies need to follow while processing the personal data of European citizens.

“The commission appears to be moving toward an exemption-based model – where actors are relieved of obligations simply because of their size or sector. This risks leaving people unprotected in precisely the areas where data use is most harmful: AI-driven decision-making, behavioral profiling and biometric surveillance,” a spokesperson for European Digital Rights said, the Brussels advocacy organization that coordinated the letter.

“Many of the GDPR’s problems stem from under-enforcement, not from the rules themselves. But instead of addressing this, the focus is shifting toward watering down the law, risking the dismantling of a globally respected framework for fundamental rights,” Itxaso Domínguez said, policy advisor at rights group EDRi.

The commission proposal comes amid growing criticism against the EU from American tech companies and the Trump administration.

Speaking at the AI Action Summit in Paris this year, U.S. Vice President JD Vance said that EU regulations such as the GDPR and Digital Services Act mean “paying endless legal compliance costs” and risking “massive fines” (see: US VP Vance Calls for Less Regulation at AI Action Summit).

“We need our European friends, in particular, to look to this new frontier with optimism rather than trepidation,” Vance said.

Meta CEO Mark Zuckerberg earlier this year called on the Trump administration to prevent the EU from fining U.S. tech companies, stating they pay more than $30 billion annually to the EU for various penalties.

Meta and Apple are among the leading American companies that have delayed the rollout of their products in the EU, fearing regulatory setbacks.

Last week, two European rights group sought legal injunction against Meta for its proposed plan to train its AI models with the personal data of Facebook and Instagram users (see: Meta Faces More European Legal Hurdles Over AI Data Training).