Leaked EU proposal would broaden AI access to personal data

A leaked document from the Irish Presidency proposes that EU member states allow personal data processing “in the context of AI” by default, according to privacy group noyb. The proposal, linked to the Digital Omnibus process, would treat companies as having an overriding legitimate interest when training or using AI products, without asking users for consent.

Noyb says the change would benefit companies including OpenAI, Anthropic, Google, Meta and SpaceX by allowing them to use personal data collected over past decades, including data from people who were never direct customers. Max Schrems described the proposal as a “digital expropriation” of Europeans and argued that commercial interests would take precedence over the fundamental right to data protection.

The proposal would move Article 88c, now referenced as Article 88bis in a Council document, toward legalising an entire technology rather than specific processing purposes. Noyb warns that activities previously considered unlawful, such as personal advertising without consent, could become legal if carried out with AI.

Further proposed changes would narrow the definition of personal data, affect pseudonymous identifiers such as user IDs, tracking IDs and IP addresses, and limit data subject rights in cases deemed abusive. Noyb argues these changes could make GDPR enforcement slower, more complex and harder to achieve.