EU Could Legimitate Use of Personal Data for AI Training

Set Trending Topics as a preferred source on Google.

The European Commission’s “Digital Omnibus” has entered its decisive phase in the Council of the EU, and the negotiations now reach into the core of the General Data Protection Regulation. The Vienna-based privacy organisation noyb has just published two internal Council documents first reported by Politico: the revised compromise text of the Irish Council Presidency and the drafting suggestions submitted by the German government. Both carry the marking “LIMITE”, which means they were not meant for the public.

At the centre sits a new provision, labelled Article 88c in the Commission proposal and renumbered Article 88 bis in the Council text. It sets out the legal basis on which personal data may be processed “in the context of the development and operation” of AI systems and AI models.

What the Presidency Compromise Text Says

The Irish Presidency text (Council document 12535/26) states in Article 88 bis that processing personal data in the context of the development and operation of an AI system or AI model may be carried out “for a legitimate interest of the controller”, meaning it would rest on Article 6(1)(f) GDPR. A balancing test against the fundamental rights of data subjects remains in the text, as does a reference obliging controllers to choose an appropriate lawful ground under Article 6.

The compromise text also adds a sentence to the definition of personal data in Article 4: “Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person.” Whether data counts as personal would therefore depend on the specific entity holding it and the means available to that entity. A further change concerns Article 12(5): controllers could refuse a data subject request where a person “abuses the rights conferred by this regulation for purposes other than the protection of their data”.

The German Drafting Suggestions in Detail

The document containing the German comments (Council document WK 11020/2026 ADD 4, filed under the heading “GER Drafting suggestions”) goes further than the compromise text in several places. The central sentence Germany wants inserted into paragraph 1 of the new article reads:

“The processing of personal data for the training and technical operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model shall be presumed as a legitimate interest within the meaning of this provision.”

What the Presidency frames as an option to rely on a legitimate interest would become a statutory presumption. In the same paragraph, the German text deletes the qualifier “where appropriate” along with the reference to national laws that explicitly require consent.

A second presumption concerns purpose limitation. A new paragraph 2 states:

“The processing pursuant to paragraph 1 of data which has been collected or recorded for other purposes than those pursuant to paragraph 1 shall be presumed to be compatible with the initial purposes and be subject to the application of approriate safeguards”

Data originally collected for entirely different purposes would therefore count as compatible with AI training as a general rule.

The furthest-reaching change sits in the proposed paragraph 6, which concerns data subject rights:

“The obligations and rights set out in Art. 14 and 16 to 18 shall not apply if compliance proves impossible or would involve a disproportionate effort.”

That covers the duty to inform people whose data was not collected directly from them (Article 14), the right to rectification (Article 16), the right to erasure (Article 17) and the right to restriction of processing (Article 18). In their place, the German text would require controllers to publish, before training, that personal data will be used for AI training, to explain how an objection or a rectification can be filed “effectively”, and, after training, to apply all technically available measures that prevent disclosure of personal data or identification of the data subject. The Commission would issue guidelines under Article 96 of the AI Act.

What Germany proposes to delete is equally telling. In the safeguards clause in paragraph 4, the list of guarantees drafted by the Presidency disappears, including data minimisation at the source selection stage and, explicitly, “providing data subjects with an unconditional right to object to the processing of their personal data”. What remains is protection “against disclosure of residually retained data in the AI system or AI model”.

The German text does contain limits that work in favour of data subjects. Under paragraph 3, the presumption would not apply where processing is specifically directed at identified or identifiable individuals, where a system is designed for the identification, monitoring or evaluation of people, or where it serves the synthetic generation of the voice, image or other personal characteristics of a specific person. Processing carried out by public authorities in the performance of their tasks is excluded outright, and paragraph 7 confirms that the remaining provisions of the GDPR are unaffected.

noyb’s Criticism: A “Digital Expropriation”

Max Schrems, founder of noyb, accuses the Council of placing the interests of large AI companies above the fundamental right to data protection. “The proposal makes clear that the interests of AI companies are meant to take precedence over the fundamental right to data protection in future. That is nothing other than the digital expropriation of Europeans,” Schrems says. In noyb’s reading, the clause would cover any personal data a company can get its hands on, including data belonging to people who were never its customers.

A further point of criticism concerns the breadth of the clause. Because it attaches to a technology rather than to a defined purpose, noyb argues, every form of AI would be privileged. “It is like saying everything is allowed if it happens with a ‘quantum computer’, no matter what you do with it,” Schrems says. On the German position, noyb points to its own survey, in which only 7 percent of German Meta users said they wanted their data used for AI training.

The redefinition of personal data has also drawn criticism from the European Data Protection Board and the European Data Protection Supervisor. In a joint opinion, both raised significant concerns that the level of protection could fall. noyb had warned of a far-reaching GDPR overhaul before the package was officially presented, and the planned loosening of the AI Act was contested early on.

The Counter-Argument: Simplification Rather Than Deregulation

The European Commission justifies the Digital Omnibus as immediate relief for companies, public administrations and citizens alike, and as a way to strengthen competitiveness. Compliance should cost less while the objectives of the rulebook stay in place. In the Commission’s view, most of the changes amount to clarifications that leave the level of protection untouched.

Parts of the business community argue that legal uncertainty around AI training is the real problem. Bitkom, the German digital industry association, calls for “targeted and proportionate adjustments” that address known practical friction in the existing framework without weakening fundamental rights or protection standards. Industry groups point out that European providers currently have little clarity on which legal basis allows them to train models, while competitors outside the EU train theirs elsewhere.

Context matters on procedure as well. The Presidency compromise is a negotiating document, and the German comments are drafting suggestions from one delegation. Whether Article 88 bis makes it into the Council’s general approach, and in what form, remains open. Earlier Council documents showed several member states keeping their distance from the Commission on pseudonymisation, automated decisions and data subject rights.

What Happens Next

The Digital Omnibus has to be adopted by both the Council and the European Parliament, and early 2027 is considered the earliest realistic date for a conclusion. Parliament’s position is still unsettled: parts of the European People’s Party back far-reaching simplification, while members of the centre-left groups and parts of the right-wing groups are pushing back.

It also remains open whether a provision of this kind would survive review by the Court of Justice of the European Union. The court has struck down encroachments on the fundamental right to data protection several times before, including on data retention and on transfers of EU data to the United States. Schrems expects the courts to have the final word: “That would only create more legal uncertainty, because companies would be relying on laws that are extremely unstable.”