Several attempts and technical-level meetings had to take place for the ambassadors of the Twenty-Seven to decide to give their approval to the negotiating position on the new community digital rules. The last loose ends of the package with which Brussels intends to simplify the technological regulatory framework and, at the same time, "stimulate innovation" had encountered resistance among some capitals, with Germany among the countries that had blocked the agreement.
This week has been when the final adjustments of the so-called "digital omnibus" received the endorsement of the EU Council to begin negotiations with the European Parliament towards its definitive adoption.
The truth is that the text introduces key modifications to the General Data Protection Regulation (GDPR), the Data Act, and the Artificial Intelligence Act. Community sources assure that the central objective "is to eliminate complexity," although the more skeptical warn that the reform would be opening the door to using specially protected information during the training of AI systems.
"The Irish Presidency has worked to achieve a timely agreement in the Council, so that these improvements can start generating real benefits as soon as possible," stated Ireland's Minister of Foreign Affairs, Helen McEntee.
Legitimate interest enters AI training
Finally, the draft on which the definitive agreement will be negotiated establishes specific rules to enable and regulate the use of personal data throughout the entire lifecycle of artificial intelligence systems. This includes everything from their training to the phases of testing, validation, and subsequent operation.
Member States have agreed to explicitly clarify that the development and operation of AI systems, including large language models and generative video systems, can be based on the legitimate interest of the data controller, one of the legal bases contemplated in the GDPR. Likewise, authorities and public bodies may rely on the legal basis of public interest or the exercise of public powers when developing or training their own artificial intelligence models.
However, the development of an AI model will not constitute, by itself, an automatic legitimate interest. Its application must be evaluated in each specific case, weighing the purpose pursued by the developer against the rights and freedoms of the users.
This legal basis cannot be used when the rights of the interested parties prevail, especially if it concerns minors, or when a legal provision expressly requires consent to carry out a specific processing.
What happens with sensitive data?
One of the main technical novelties of the agreement lies in the way of addressing the unforeseen presence of especially sensitive data, such as those related to health, ethnic origin, or political opinions, in the large volumes of information used to train artificial intelligence models.
The Council aims to introduce a new exception to allow the incidental and residual processing of special categories of data when these do not constitute the objective of the data controller. That is, the flexibilization does not imply a general authorization to deliberately collect sensitive information for the purpose of training AI systems, but rather seeks to provide a legal response to those cases in which this data appears unexpectedly in the training sets.
To this end, developers must previously apply technical and organizational measures, such as filtering mechanisms during the collection phase, aimed at preventing the incorporation of specially protected information.
Now, if, despite these precautions, sensitive data is detected in the training sets, during validation or in the system itself, the controller will be obliged to delete them without undue delay.
The proposal also contemplates those scenarios in which deletion is technically impossible or requires a manifestly disproportionate effort. For example, when certain information has been "memorized" in the model's weights and its deletion requires a new training process. In these cases, the controller must ensure effective protection of the affected data, preventing it from being further processed, avoiding its use to generate inferences, and adopting measures so that it cannot be disclosed to third parties.
More flexibility, but also new safeguards
To compensate for this flexibilization of the legal bases, the text incorporates a series of additional obligations aimed at artificial intelligence developers. Firstly, they must apply the principle of data minimization from the very selection of information sources, in addition to implementing instruments aimed at preventing leaks or undue disclosures.
Along with these guarantees, the proposal recognizes users' unconditional right to oppose the processing of their personal data for the development of these technologies.
Another relevant change affects the very interpretation of the concept of personal data. Member States have wanted to clarify that, following the jurisprudence of the Court of Justice of the European Union (CJEU), information should not necessarily be considered personal data for any entity simply because a third party can identify the user.
Thus, when an organization does not have reasonable means to identify a person, that information may cease to be considered personal data from the perspective of that entity. This interpretation also affects pseudonymized data transmitted to third parties, which may fall outside this consideration for the recipient when the possibility of re-identification is insignificant or technically impossible.
Furthermore, the draft introduces adjustments in the exercise of the access rights contemplated in the GDPR. Data controllers may reject or charge for those requests that are manifestly abusive or excessive, including mass automated requests launched through malicious AI agents.
A reorganization of the European regulatory ecosystem
Beyond data protection, the digital omnibus proposes a restructuring of the European regulatory ecosystem with a direct impact on the competitiveness of the Union's technology sector.
The proposal contemplates the repeal of complete chapters of the Data Governance Act and the integration of the provisions of the Open Data Directive within the Data Act. With this, Brussels aims to concentrate a large part of the regulatory framework into two major regulatory instruments, reducing legislative fragmentation and administrative burdens for companies.
According to the community institutions, this reorganization will simplify the necessary procedures to access public and research data, facilitating its reuse by economic operators. Furthermore, the registers of data intermediation services and data altruism organizations will become voluntary, accompanied by a recognition seal from the EU.
The text also incorporates provisions aimed at strengthening the position of small and medium-sized enterprises against large technology platforms. In particular, public authorities will be able to establish special conditions and higher fees for the gatekeepers, that is, the access guardians designated under the Digital Markets Act, when they request to reuse certain open or protected data.
Finally, the Council introduces a so-called "handbrake mechanism" aimed at protecting trade and industrial secrets against access requests from third countries. This tool will allow for the establishment of restrictions when there are risks of leaking sensitive business information or when the requesting jurisdictions do not provide sufficient legal guarantees to ensure its protection.
With this set of modifications, the Twenty-Seven seek to move towards a less fragmented digital framework that is more favorable to European technological development. However, the balance between regulatory simplification, industry competitiveness, and effective protection of fundamental rights will again be at the center of negotiations with the European Parliament, especially regarding the use of personal data and special categories of information for the training of artificial intelligence.