Full Breakdown
European Commission Proposes Overhaul of GDPR and Digital Regulations
11/22/2025, 2:22:08 AM
Overview of the Proposal
On November 19, 2025, the European Commission introduced a comprehensive proposal to revise the General Data Protection Regulation (GDPR) as part of a broader initiative termed the "Digital Omnibus." This package aims to simplify compliance for businesses while maintaining high standards of data protection and privacy. The revisions are expected to reduce regulatory burdens on EU firms, potentially saving them up to €5 billion by 2029.
Key Changes to Personal Data and Consent
One of the most significant amendments involves redefining personal data. The proposal shifts from a universal standard to an entity-relative concept, meaning that data will only be considered personal if the entity can identify the data subject using its own means. This change could allow companies, such as adtech firms, to argue that certain data is non-personal, thereby reducing regulatory scrutiny.
Additionally, the proposal introduces a stricter purpose-based regime for obtaining user consent. Under the new Article 88a, processing without consent will only be permissible in four specific scenarios, including security maintenance and services explicitly requested by the user. This aims to address issues of "consent fatigue" and deceptive practices in user interfaces.
Implications for AI and Data Processing
The proposal also impacts the use of special-category data in AI model development. Under the new Article 9(2)(k), organizations can process such data if they make efforts to avoid collecting it and protect it from influencing outputs. This flexibility is intended to foster innovation while still upholding privacy safeguards.
Furthermore, the proposal clarifies the treatment of pseudonymised data, empowering the Commission to define when such data can be considered non-personal. This could facilitate new applications in data analytics and research.
Criticism and Opposition
Despite the potential benefits, the proposal has faced significant criticism. European Digital Rights (EDRi) has labeled the changes a "massive reopening" of core digital protections, warning that they could weaken privacy safeguards and expand opportunities for corporations to process personal data with less oversight. Consumer and civil society groups have expressed concerns that the reforms prioritize innovation over fundamental rights.
Industry reactions have been mixed. While some technology groups welcomed the adjustments, others, like the Computer and Communications Industry Association (CCIA), argued that the proposals do not go far enough in addressing existing challenges within the EU's digital ecosystem.
What's Next?
The proposed changes must undergo a legislative process, requiring approval from both the European Parliament and the Council of Europe. If passed, the reforms could significantly reshape the regulatory landscape for data protection and AI in the EU, potentially influencing global standards.
Verbatim Quotes
- “[T]his package must only be the starting point for deeper reform of the EU’s digital rulebook,” — Computer and Communications Industry Association (CCIA)
The European Commission's Digital Omnibus represents a pivotal moment in the evolution of data protection and AI regulations, balancing the need for innovation with the imperative of safeguarding individual privacy rights.
