European Commission to Propose New Limitations to GDPR Rules

The proposed amendments represent a substantial departure from the prevailing current interpretations of GDPR definitions and could lead to major changes in how enterprises and organizations process personal data.

According to internal Commission documents viewed by PPC Land, the proposed amendments stipulate that “information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person.”

Instead, personal data subject to enhanced protections would be limited to that which “directly reveals in relation to a specific data subject” specific categories of information such as health status, political views or sexual orientation.

The proposal explicitly excludes information derived through “intellectual operation involving comparison, cross-referencing, collation or deduction” from enhanced protection.

According to an analysis of the draft by data protection advocacy organization noyb, the new definition could potentially exclude sensitive information inferred from aggregated statistics that is commonly used for targeted advertising and security purposes, such as data collected from personal devices or pseudonymous data gathered via tracking technology such as cookies or pixels.

The proposed changes would also greatly expand the scope of personal data that can be used to train AI models. Under the proposed amendments, processing of personal information for AI training would be permitted “except where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject.”

According to the noyb analysis, provision would apply to AI systems as defined in the AI Act, encompassing a broad range of automated processing activities beyond traditional machine learning models.

The changes to AI data processing rules come atop other proposals in the omnibus package that could delay enforcement of the strictest provisions of the AI Act by at least a year and shift some enforcement activity from national data authorities to the central AI Office under the Commission.

The proposals to limit the scope of the GDPR would mark a significant turnabout by the European Union. In the decade since its passage, GDPR has acted as a de factor global standard for privacy protection, influencing laws in several non-European countries and helping establish the so-called Brussels Effect in digital technology regulation.

The changes drew immediate fire from privacy advocates as well as some analysts. “Some aspects of the Commission’s plan appear sensible. But the deep GDPR revisions it is considering are more likely to future suppress Europe’s technology competitiveness and make U.S. tech giants entirely unassailable,” wrote Johnny Ryan of the Irish Council for Civil Liberties. “Aside from the grave hazard to fundamental rights, the competitiveness case for what the Commission is contemplating is bad.”

According to Ryan, the changes to rules regarding personal data in AI would “free the U.S. tech giants from any fear of enforcement against their using their data free-for-alls for AI training. With years of ill gotten data gains now unassailable, a European competitor would be even more challenged to catch up.”

The final draft of the digital omnibus is scheduled to be released November 19, but would still need to be approved by the European Parliament and the European Council to become effective.