Brussels Tries to Fix the GDPR Without Making It Worse

In this article for Truth On The Market, author Mikolaj Barczentewicz explores the EU’s evolving efforts to reform the GDPR through the Digital Omnibus. The author argues that, after years of ineffective reform attempts, the Irish Council presidency has reopened negotiations on key issues including pseudonymization, cookie consent, AI data processing, and reducing compliance burdens. Meanwhile, the European Parliament and European Data Protection Board (EDPB) are taking different positions on the scope and implementation of the reforms.

The author highlights four fronts in the reform debate: the Council’s renewed approach, Parliament’s anticipated amendments, the EDPB’s new anonymization guidance, and a separate AI Omnibus that has already entered into force. The EDPB has accepted the “entity-relative” view that whether information is personal data depends on the entity processing it, but Barczentewicz argues that its guidance remains too vague to provide businesses with meaningful compliance certainty.

Three substantive issues are particularly important: the definition of personal data, cookie consent, and AI development. Barczentewicz argues that procedural reform may matter more than changing the definition itself, particularly by giving the European Commission greater authority to issue legally binding implementation rules. He also examines competing proposals on cookie exemptions and browser-based consent, as well as provisions that could clarify the use of legitimate interests and sensitive personal data in AI development and training.

Looking ahead, the author notes that Parliament received more than 1,000 amendments, meaning negotiations are likely to continue through the autumn and into 2027. The EDPB’s anonymization consultation may further shape the debate, while Ireland has six months to build consensus among EU governments. Barczentewicz concludes that the outcome will depend on whether policymakers genuinely pursue practical simplification of the GDPR or merely create another layer of complex regulatory guidance…