EU Digital Omnibus GDPR Strand: Irish Presidency Compromise Would Let AI Training Proceed on "Legitimate Interest" — With Safeguards Stripped and Pseudonymized Data Recast

EU Digital Omnibus GDPR Strand: Irish Presidency Compromise Would Let AI Training Proceed on "Legitimate Interest" — With Safeguards Stripped and Pseudonymized Data Recast

While the AI strand of the EU Digital Omnibus is already law (Regulation (EU) 2026/1744, in force July 27, 2026 — see EU Digital Omnibus on AI Is Now Law: Formal Adoption Completed July 2026, Annex III High-Risk Obligations Deferred to December 2, 2027), the second strand — amending the GDPR and ePrivacy Directive — moved decisively in September 2026. noyb published two restricted Council documents on September 21, 2026: the Irish Presidency's 158-page compromise text 12535/26 (dated September 3, LIMITE, circulated for the September 11 Antici Group meeting) and Germany's working paper WK 11020/2026 ADD 4 (August 17). The Council is not yet at a settled mandate; Parliament is still developing its position, and trilogues follow.

1. AI training gets a statutory legitimate-interest basis — with the Commission's safeguards struck from the operative text. The Commission's Article 88c becomes Article 88 bis, whose first paragraph reads: "The processing of personal data in the context of the development and operation of an AI system or of an AI model may be carried out for a legitimate interest of the controller or a third party in accordance with Article 6(1)(f) of this Regulation.¹" What was cut matters as much as what remains: the Commission's qualifiers — "where appropriate," the carve-out where "other Union or national laws explicitly require consent," the child-priority override, and four example safeguards (data minimisation, protection against residual disclosure, enhanced transparency, and "an unconditional right to object to the processing of their personal data") — are all struck through in the Presidency's operative article. The Article 6(1)(f) balancing test survives by cross-reference, and a new non-binding recital 33a keeps part of the deleted language, but recitals "guide interpretation. They do not bind in the way articles do."

2. Germany wants a presumption. Berlin's paper would add that processing "for the training and technical operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model shall be presumed as a legitimate interest within the meaning of this provision," would treat data "collected or recorded for other purposes" as "presumed to be compatible with the initial purposes," and would disapply the Article 14 information duty and Articles 16–18 rights (rectification, erasure, restriction) where compliance "proves impossible or would involve a disproportionate effort."

3. The "personal data" redefinition lands in a new Article 25a. The Commission's Article 4(1) additions are struck; the Council instead provides: "Pseudonymised data shall not be considered personal data for a person if that person is unable to identify the natural person to whom the data relates, unless paragraph 5 applies," adding that "a natural person is not identifiable where the likelihood of identification is insignificant in practice." This tracks the CJEU's September 4, 2025 EDPS v Single Resolution Board judgment more closely than the Commission draft, and carries two safeguards (processor-side data remain personal to the processor; onward transmission to a party with re-identification means counts as processing). noyb warns most IT systems run on pseudonyms — user IDs, tracking IDs, IP addresses. EDPB Chair Anu Talus said the proposed changes were "not in line with the Court's case law and would significantly narrow the concept of personal data."

4. Other moves: cookie/device-access consent rules return to ePrivacy Article 5(3) (Articles 88a/88b struck — the machine-readable browser-signal duty is gone after Google lobbying), with a new exemption for contextual-advertising measurement; the Commission's redraft of Article 22 as a permission is reversed — the Council restores the right not to be subject to solely automated decisions; a new Article 9(2)(k) covers "unintentional and residual" sensitive data in AI development.

Opposition and stakes. Max Schrems: "This is nothing but a digital expropriation of Europeans" — "many things that were previously illegal would suddenly be legal, as long as you use AI." EDRi warned on September 23 that "EU governments could be just days away from agreeing to a disastrous deal on the Digital Omnibus on Data." For enterprises, the redefinition could reclassify pseudonymized AI training and operations data out of GDPR scope for entities lacking realistic re-identification means — materially shifting developer and deployer data-protection liability across the EU — while the AI legitimate-interest clause would give AI training a statutory basis without AI-specific conditions in the operative text. Neither chamber has agreed; watch for the Council mandate, Parliament's position, and any CJEU-facing fundamental-rights challenge (Schrems explicitly tees up litigation).