- Personal data and pseudonymisation: The Commission’s original draft of the Digital Omnibus (Commission draft) proposed amending the definition of personal data, making the relevant factor whether a specific entity can identify an individual, taking into account the means that entity is likely to use.
The Council text has deleted the amended definition, but added a new Article 25a to clarify the rules on pseudonymised data:
- Controllers and processors may apply pseudonymisation in such a manner that personal data can no longer be attributed to a specific data subject without the use of additional information.
- Pseudonymised data shall not be considered personal data for a third party if that third party is unable to identify the natural person to whom the data relates.
- Where a third party discloses, transmits or otherwise makes pseudonymised data available to another third party who possesses or can obtain means reasonably likely to enable the data subject to be identified, both the transmission of the data to that other third party and the subsequent processing of the data by that other third party is processing of personal data.
- Where a processor processes personal data on behalf of a controller, that data shall be considered personal data for the processor.
- To determine whether a natural person is identifiable, including through personal data having undergone pseudonymisation, account shall be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly.
- The European Data Protection Board (EDPB) must issue an opinion addressing the application of pseudonymisation and anonymisation, including related technical and organisational measures.
These amendments are intended to address the concerns raised by the EDPB and the European Data Protection Supervisor (EDPS) in their joint opinion on the Digital Omnibus. The EDPB opinion will be critical to resolving the uncertainty caused by inconsistencies between recent case law of the CJEU, the Commission’s attempts to codify this in the Commission draft, and the EDPB/EDPS concerns.
- Scientific research: The Commission draft proposed amending the definition and relaxing the further processing and transparency rules relating to personal data used for this purpose. The Council text makes some changes to clarify the definition and the safeguards that must be applied when relying on the exemptions.
- Special category data:
- Biometric verification: The Commission draft proposed introducing a new condition that permits the processing of special category data for biometric verification under the user's sole control, subject to safeguards. The Council text clarifies that this only permits a one-to-one comparison of biometric data provided by the data subject, as distinct from a “one-to-many” search of the data subject’s biometric data in a database.
- AI systems: The Commission draft proposed adding new conditions that permit the processing of special category data for the development and operation of an AI system or model. The Council text limits this to incidental processing of residual data and provides that this derogation only applies where erasing the data would be technically impossible or require manifestly disproportionate effort.
- Training AI models: The Commission draft proposed an amendment to the GDPR to explicitly provide that legitimate interest can be used as the lawful basis to process personal data to train AI models. The Council text removes the proposed GDPR amendment, but adds a new recital to the Digital Omnibus to clarify that the development and operation of an AI system or AI model does not in itself constitute a legitimate interest, and processing in the context of AI must be assessed on a case-by-case basis, taking into account the underlying purpose of the processing.
- DSARs: The Commission draft proposed extending the circumstances in which a controller may reject a data subject access request (DSAR) or charge a reasonable fee to where the data subject is abusing their GDPR rights for purposes other than protecting their data. The Council text limits this to where the controller can demonstrate abusive intention on the part of the data subject, and removes the reference to them abusing their GDPR rights for purposes other than protecting their data. An amended recital to the Digital Omnibus provides examples of where abusive intention may arise, such as:
- submitting excessive numbers of identical or largely similar requests with the sole intent of harming the controller;
- submitting a request, but at the same time offering to withdraw it in return for some form of benefit;
- submits a request with the sole purpose of obtaining compensation for an alleged infringement which is deliberately provoked by the data subject; or
- with the intention to adversely affect and burden public authorities, for instance by utilising AI agents for malicious automated requests.
- Privacy notices: The Commission draft proposed that controllers will not be required to provide a privacy notice in certain limited situations where they collect data directly from the individual. The Council text makes some amendments to limit when this exemption applies.
- Automated decision making (ADM): The Commission draft proposed amending Article 22 of the GDPR to: (i) change it from a right not to be subject to ADM to a provision setting out when ADM is permitted, and (ii) provide that solely automated decisions which have a legal or similarly significant effect on an individual can be taken when necessary for entering into or performing a contract with the data subject, regardless of whether the decision could be taken otherwise than by solely automated means.
The Council text reinstates the right not to be subject to ADM unless an exception applies, deletes the reference to whether the decision could be taken by other means, inserted additional safeguards, and provides that ADM can only be based on special category data if the lawful basis of explicit consent or substantial public interest applies.
- Data breach notifications: The Commission draft included a number of proposals: (i) controllers would only be required to report personal data breaches posing a high risk to data subjects; (ii) reports would be made via a single-entry point for reporting incidents under the GDPR, NIS2, DORA and the Critical Entities Resilience Directive; (iii) the reporting deadline would be increased from 72 hours to 96 hours; and (iv) the EDPB would need to establish a template for notifying breaches and a list of circumstances in which a breach is likely to result in a high risk.
The Council text retains the provision that breaches which do not result in a high risk to data subjects do not need to be reported. However, it makes a number of changes, including:
GDPR
- adding a requirement for the EDPB to prepare a list of circumstances in which a breach is likely or not likely to result in a high risk.
NIS2
- replacing the single-entry point with a requirement for each member state to create a national entry point for reporting incidents as required by EU law and endeavour to design their national entry point with a view to interoperability with other member states’ national entry points; and
- providing that ENISA (the EU Agency for Cybersecurity) will develop and maintain an incident reporting information point to support the identification and fulfilment of the obligation to report incidents and related events, including by enabling users to identify reporting obligations and be redirected to the appropriate national entry point.
Trade secrets: The Council text includes amendments to the Data Act to strengthen the “trade secrets handbrake” by providing that:
- trade secrets would have to be disclosed only once the data holder and the user have taken all necessary measures to preserve their confidentiality; and
- data holders will not be required to disclose trade secrets if they can demonstrate that they are likely to suffer serious economic damage from the disclosure, or the disclosure poses a significant risk of unlawful transfer to third countries with weaker protection compared to that under EU law.
In addition, it imposes an obligation on the Commission to issue guidelines for data holders to apply the handbrake in practice.
