GDPR reform in the Digital Omnibus

The reform has moved from a general entity-relative definition towards a specific rule for pseudonymised data. The core principle has broad support, but its operational criteria and legal effect remain contested.

Court of Justice, September 2025. In EDPS v SRB (C-413/23 P), the Court held that pseudonymised data must not be regarded as personal data “in all cases and for every person”, because pseudonymisation may, depending on the circumstances, prevent persons other than the controller from identifying the data subject. [EDPS v SRB, para 86] Data become personal for a transfer and any later processing “in so far as it cannot be ruled out” that the recipient has means reasonably allowing it to attribute them to the data subject. [EDPS v SRB, paras 84⁠–⁠85] The controller’s duty to inform data subjects about recipients was assessed from its own perspective at the time of collection. [EDPS v SRB, paras 110⁠–⁠112] The judgment interprets the regulation that applies to the Union institutions (Regulation (EU) 2018/1725). [EDPS v SRB, para 86]

My November 2025 assessment. In my response to the leaked proposal, I welcomed an entity-relative definition and argued that separating identifying information from other processing could benefit both data minimisation and privacy.

Commission proposal. Three sentences would be added to GDPR Article 4(1). [Commission proposal, Article 3(1)(a), proposed Article 4(1)] Their central proposition is that information can be personal data for an organisation able to identify an individual, yet fall outside the GDPR for another organisation lacking reasonably likely means of identification. The mere possibility that a later recipient could identify the person would not, by itself, make the information personal for the first organisation. [Commission proposal, Article 3(1)(a), proposed Article 4(1)] Proposed Article 41a would support that rule with Commission implementing powers.

EDPB–EDPS Joint Opinion. The authorities opposed the definition change. They argued that the proposed final sentence does not accurately reflect, and goes beyond, CJEU case law. Their objection concerned selective codification. A recipient’s capabilities cannot be considered without the rules governing disclosure, the original controller’s responsibilities and arrangements that leave identification possible in practice. The opinion recommended deleting the proposed definition change. [EDPB–EDPS opinion, paras 14⁠–⁠21 and footnote 25]

My March 2026 comments. In my comments for the International Center for Law & Economics, I welcomed the entity-relative definition in the proposal. [ICLE comments, section I.H.1] I argued that controllers relying on non-identifiability should bear the burden of demonstrating that their measures prevent identification, and that singling out a device or session does not by itself identify a person. [ICLE comments, sections I.F.1⁠–⁠I.F.2] I also urged the co-legislators to keep Article 41a, give compliance with its criteria the effect of a rebuttable presumption of non-identifiability, and not leave the question to EDPB guidance alone. [ICLE comments, sections I.G and I.H.3⁠–⁠I.H.4]

May Presidency compromise. The Commission’s addition to Article 4(1) was removed [Commission proposal, proposed Articles 4(1) and 41a], and the proposed Article 41a implementing power was recast as an Article 29a centred on an EDPB opinion. [21 May Council text, Article 3(1)(a) (deleted), recital 27a and Article 3(10), proposed Article 29a]

June Presidency compromise. The replacement’s entity-relative effect was made explicit. Article 29a(2) said that pseudonymisation may, depending on the circumstances and effective technical and organisational measures, prevent people other than the controller from identifying the data subject. For those recipients, the subject may no longer be identifiable. Paragraph 3 preserved other applicable obligations and expressly excluded processors from paragraph 2. Paragraphs 4–5 required an EDPB opinion on pseudonymisation and anonymisation, including the relevant circumstances and measures. The Commission implementing-act machinery was deleted. [18 June Council text, proposed Article 29a(1)⁠–⁠(5), pp. 115⁠–⁠116]

Joint rapporteurs’ draft. The June draft did not propose changing the Commission’s Article 4(1) addition or its GDPR Article 41a power. [Joint draft report, GDPR amendments, Amendments 43⁠–⁠67] That left the Commission wording in the baseline for their draft, without establishing that both rapporteurs endorse it as their final position. [Joint draft report, GDPR amendments, Amendments 43⁠–⁠67]

EDPB anonymisation guidelines. The July draft guidelines expressly accepted that information may be anonymous for one entity and personal for another. They also accepted that successful anonymisation need not require deletion of the original data. [Anonymisation guidelines, paras 6⁠–⁠10] Three qualifications are especially consequential:

• A processor does not simply acquire an independent perspective. Where an organisation processes data on behalf of a controller, the guidelines apply the controller’s perspective. Outsourcing processing without handing over the identification key therefore does not automatically remove the processor from the GDPR. [Anonymisation guidelines, para 15]
• Onward disclosure can change the assessment. Where a transfer to a third party is reasonably likely and “it cannot be ruled out” that the recipient has reasonably likely means of identification, the guidelines treat the data as personal for the transfer and the recipient’s processing, and indirectly for the transferring entity. [Anonymisation guidelines, para 21] The formula follows EDPS v SRB, which the guidelines cite. [Anonymisation guidelines, para 21, footnotes 17⁠–⁠18] [EDPS v SRB, paras 84⁠–⁠85] The Commission’s proposed Article 4(1) refers to a mere potential later recipient, while recital 27 says that disclosure makes the information personal only for the identifying third party. [Commission proposal, recital 27 and proposed Article 4(1)]
• Separation must work in practice. Contracts and legal prohibitions matter, but they need to constrain the relevant actors effectively. [Anonymisation guidelines, paras 32⁠–⁠35 and 89⁠–⁠93] Technical change and changes in the available auxiliary data can require reassessment. An organisation needs evidence about the arrangement it actually operates.

Irish Presidency discussion note. Delegations were asked for their position on Article 29a and how to achieve meaningful simplification and legal certainty. [Irish discussion note, section 1]

July MEP amendments. Two amendments to recital 27 demonstrate disagreement between the joint rapporteurs, Marina Kaljurand and Aura Salla. Kaljurand and colleagues’ Amendment 214 would reduce the recital to the general statement about targeted clarification and simplification while preserving protection. [Amendments 79–250, Amendment 214] Salla and colleagues’ Amendment 216 would retain the entity-relative explanation and add objective factors such as identification costs, time and technological developments. [Amendments 79–250, Amendment 216] It would also qualify the result. Under that amendment, likely onward disclosure to an identifying recipient could make the information personal indirectly for the controller, and it would call for pseudonymised data to be treated as personal where the recipient’s identification means cannot be ruled out. [Amendments 79–250, Amendment 216] That passage repeats the Court’s wording in EDPS v SRB almost verbatim. [EDPS v SRB, para 85]

The tabled amendments to Article 4(1) show the options preferred by various MEPs:

• Deletion. Kaljurand and colleagues’ Amendment 932 would delete the Commission’s three added sentences. Pernando Barrena Arza’s Amendment 929 and Julie Rechagneux and colleagues’ Amendment 935 would make the same deletion. The co-rapporteur’s own amendment makes her disagreement with Salla’s qualified-retention approach explicit. [Amendments 777–1052, Amendments 929, 932 and 935, pp. 91⁠–⁠94 and 96⁠–⁠97]
• Qualified retention. Salla and colleagues’ Amendment 940 would retain an entity-relative rule depending on the circumstances, but make the information personal where it is, or is likely to be, disclosed to someone with means reasonably likely to identify the individual. [Amendments 777–1052, Amendment 940, pp. 100⁠–⁠101]
• A separate exclusion. Alice Teodorescu Måwe’s Amendment 947 would exclude certain data primarily relating to an enterprise or object, subject to three cumulative conditions: the person is associated only as an owner, employee or similar; processing is not specifically related to that person; and safeguards prevent person-specific use. [Amendments 777–1052, Amendment 947, pp. 105⁠–⁠106]

My July 2026 assessment. My July update welcomed the EDPB’s acceptance of the entity-relative view but criticised its qualifications as operationally difficult to use. I read the joint draft as an initial area of agreement and noted that both rapporteurs intended to pursue issues it left untouched. Their recital and operative amendments later provided concrete examples of that divergence. I continued to support clarification but described its significance as largely symbolic following the EDPB’s acceptance of the core principle. I put greater weight on Commission implementing powers and guidance capable of creating strong legal presumptions.

September Presidency compromise. The September text renumbered proposed Article 29a as Article 25a and rewrote its recipient, processor and onward-disclosure rules. [18 June Council text, proposed Article 29a, pp. 115⁠–⁠116] [3 September Council text, proposed Article 25a, pp. 121⁠–⁠122] Proposed Article 25a would provide that pseudonymised data are not personal data for a person unable to identify the individual, subject to its onward-disclosure rule. [3 September Council text, proposed Article 25a(2), p. 121] The general Article 4(1) definition would remain unchanged. [3 September Council text, Article 3(1)(a), p. 112]

The assessment would still turn on all means reasonably likely to be used by the controller or another person, and the likelihood of identification would have to be insignificant in practice. [3 September Council text, proposed Article 25a(3), p. 122] Recital 27b identifies relevant considerations, including the state of the art of the pseudonymisation technique, the properties of the data, the cost and time needed to obtain additional information, technical measures and legal obligations. [3 September Council text, recital 27b, pp. 20⁠–⁠22] Its final sentence lists contextual factors in wording taken word for word from paragraph 13 of the EDPB’s July guidelines, ending with whether “a receiver of the data might process it on behalf of another party”. [3 September Council text, recital 27b, pp. 21⁠–⁠22] [Anonymisation guidelines, para 13] The provision would keep processors within the GDPR when they process personal data for a controller, as paragraph 15 of the guidelines also does. [3 September Council text, proposed Article 25a(4), p. 122] [Anonymisation guidelines, para 15] It would also treat an onward disclosure and the third party’s subsequent processing as personal-data processing where that party possesses or can obtain reasonably likely means of identification. [3 September Council text, proposed Article 25a(5), p. 122] Recital 27c uses the Court’s formula from EDPS v SRB to describe the task of the EDPB opinion. [3 September Council text, recital 27c, p. 22] [EDPS v SRB, para 86]

My assessment of the September text. The wording confirms a principle that the EDPB’s July guidelines already accept. [Anonymisation guidelines, paras 6⁠–⁠10] Its onward-disclosure trigger is framed positively. Article 25a(5) requires that the third party “possesses or can obtain” the means, while EDPS v SRB treats the data as personal unless those means can be ruled out. [3 September Council text, proposed Article 25a(5), p. 122] [EDPS v SRB, para 85] Where a recipient’s capabilities are uncertain, the two tests could give different answers. The text offers little practical certainty about when particular technical and legal safeguards suffice. Article 25a would leave that assessment with controllers and the authorities, supported by an EDPB opinion. [3 September Council text, recital 27c, p. 22; proposed Article 25a(6)⁠–⁠(7), p. 122] The more categorical statement of recipient-relative status supplies neither binding operational criteria nor a presumption about compliance with them. The enforcement chapter examines that missing link.

Second Irish draft, reported 21 September. MLex reported a requirement for organisations using pseudonymisation to apply technical and organisational measures to prevent others from identifying the person. [Tar and Newman on later Irish draft, p. 1] The 2 October text contains that requirement.

2 October proposed mandate. The Presidency text submitted to Coreper keeps Article 25a but reorders and rewords it. [2 October Council text, proposed Article 25a, pp. 126⁠–⁠127] Paragraph 1 now adds that the application of pseudonymisation is subject to appropriate technical and organisational measures, including security measures, to prevent other persons from identifying the data subject. [2 October Council text, proposed Article 25a(1), pp. 126⁠–⁠127] Paragraph 2 provides that pseudonymised data are not personal data for a third party unable to identify the individual. Its 3 September cross-reference to the onward-disclosure rule is gone, and that rule now follows directly as paragraph 3. [2 October Council text, proposed Article 25a(2)⁠–⁠(3), p. 127] Paragraph 4 still keeps processors within the GDPR. [2 October Council text, proposed Article 25a(4), p. 127]

The identifiability rule, now paragraph 5, still turns on all the means reasonably likely to be used. It no longer refers to means used by the controller or another person, and it no longer says that a person is not identifiable where the likelihood of identification is insignificant in practice. [2 October Council text, proposed Article 25a(5), p. 127] [3 September Council text, proposed Article 25a(3), p. 122] A version of that threshold moves into recital 27b. A third party should not be considered to have reasonably likely means where the likelihood of identification “appears in reality to be insignificant”, because identification would be impossible, would require disproportionate effort in time, cost and labour, or is legally prohibited. [2 October Council text, recital 27b, p. 26] The recital also adopts the Court’s statement in EDPS v SRB that pseudonymisation may, depending on the circumstances, prevent persons other than the controller from identifying the data subject. [2 October Council text, recital 27b, p. 26] [EDPS v SRB, para 86] It adds that the data subject remains identifiable for the controller applying pseudonymisation and for a processor acting for it. Its closing list of contextual factors now depends on “the relevant circumstances” rather than “the relevant entity’s perspective”. [2 October Council text, recital 27b, p. 26]

Recital 27a no longer says that the legal effect of pseudonymisation should depend on its actual effectiveness against the relevant recipient. It now says that pseudonymised data should remain subject to appropriate security measures, and it calls on Member States, supervisory authorities, the Board and the Commission to encourage codes of conduct on pseudonymisation. [2 October Council text, recital 27a, p. 25] The EDPB opinion and its six-month request deadline remain, without Commission implementing criteria. [2 October Council text, proposed Article 25a(6)⁠–⁠(7), p. 127]

The Council mandate agreed on 21 October keeps Article 25a and recitals 27a–27c unchanged in substance. [Council mandate · 22 October text, recitals 27a⁠–⁠27c, pp. 25⁠–⁠27; proposed Article 25a, pp. 140⁠–⁠141] It adds a paragraph to the parallel Union-institutions rule: under Article 30a(6) of Regulation (EU) 2018/1725, the EDPB would issue an opinion, in accordance with Article 64(2) GDPR, on the application of pseudonymisation and anonymisation, including the related technical and organisational measures. [Council mandate · 22 October text, proposed EUDPR Article 30a(6), p. 153]

My assessment of the Council mandate. The revisions leave the problem identified above in place. The onward-disclosure rule still applies only where the other third party “possesses or can obtain” the means. [Council mandate · 22 October text, proposed Article 25a(3), p. 140] The Court treats the data as personal unless those means can be ruled out. [EDPS v SRB, para 85] The two tests differ when a recipient’s capabilities are unknown. The recital’s impossibility, effort and legal-prohibition criteria are more concrete than “insignificant in practice”. They now sit in a recital rather than the operative text, and they remain contextual judgments for controllers and authorities. Paragraph 1 adds that pseudonymisation “shall be subject to appropriate technical and organisational measures” to prevent others from identifying the data subject. [Council mandate · 22 October text, proposed Article 25a(1), p. 140] Like other proposed provisions, this does not give much clarity and would be left for the EDPB and data protection authorities to interpret—likely as another way to restrict the applicability of the concept of pseudonymisation.

The proposed changes affect access requests, transparency duties and automated decisions. Across all three, the central questions concern evidential burdens, the breadth of exceptions and the preservation of enforceable individual rights.

Commission proposal. Article 12(5) would allow an Article 15 access request to be treated as excessive where the individual abuses GDPR rights for purposes other than protecting their data. [Commission proposal, proposed Article 12(5)] The controller would need reasonable grounds to believe a request excessive, while still bearing the burden of demonstrating that a request is manifestly unfounded. [Commission proposal, proposed Article 12(5)] The consequences would remain a reasonable administrative fee or refusal to act. [Commission proposal, proposed Article 12(5)] Recital 35 would additionally treat overly broad and undifferentiated requests as excessive. [Commission proposal, recital 35] An inconvenient or litigation-related request would not automatically be abusive, and access may help a person pursue an employment dispute, consumer claim or another legal right.

The existing Article 13(4) exception concerns information the individual already has. The proposal would replace it with an exemption from paragraphs 1–3 where data is collected in a clear, circumscribed relationship, the controller’s activity is not data-intensive, and there are reasonable grounds to assume the individual knows the controller’s identity and contact details, the purposes and the legal basis. The exemption would be unavailable for transmission to other recipients, third-country transfers, Article 22 decisions or processing likely to create high risk. [Commission proposal, proposed Article 13(4) and recital 36] Knowing the specified particulars is narrower than already having the complete Article 13 notice. The proposal could therefore dispense with information about matters such as retention and rights, even though the person has not received it.

Article 22 would be recast as permission for solely automated decisions with legal or similarly significant effects on three grounds. These are contractual necessity, authorisation by law with safeguards, or explicit consent. Its contractual ground says that the possibility of taking the decision by other means does not itself defeat necessity. Recital 38 adds that, among equally effective automated solutions, the less intrusive one should be used. [Commission proposal, proposed Article 22(1) and recital 38] This clarification would not make every commercially useful automated decision contractually necessary. The safeguards on human intervention, expression of views, contestation and special-category data would remain.

EDPB–EDPS Joint Opinion. The authorities objected to making the purpose of access decisive. Individuals need not justify their request, and a purpose beyond data protection does not by itself establish abuse. They also opposed lowering the evidential burden and treating breadth alone as excessive. [EDPB–EDPS opinion, paras 53⁠–⁠59]

They claimed to support the transparency simplification objective but sought clearly limited conditions, clarification of a non-data-intensive activity, and removal of the reasonable-grounds assumption. They also recommended requiring full Article 13 information on request and informing individuals of that possibility. [EDPB–EDPS opinion, paras 60⁠–⁠64]

For automated decisions, the authorities recommended wording that states a prohibition with specified exceptions, preserving a right individuals can invoke. They recommended leaving the human-alternative clarification in a recital, while also requiring that no equally effective and less intrusive means, automated or otherwise, be available. [EDPB–EDPS opinion, paras 65⁠–⁠72]

June Presidency compromise. Article 12(5) used demonstrated abusive intent rather than the Commission’s reference to purposes other than data protection. It would require the controller to demonstrate that a request is manifestly unfounded or excessive, taking all relevant circumstances into account. Any fee would have to be proportionate to administrative costs, and a refusal would have to give reasons. This shifted the question towards evidence of abuse rather than the presence of an additional motive. [18 June Council text, proposed Article 12(5), p. 109]

The existing Article 13(4) was preserved, and the new exception was placed in paragraph 5. It would exempt only paragraphs 1 and 2, leaving paragraph 3’s duty to inform before further processing for a different purpose. Its cumulative conditions would require a direct, clear and circumscribed relationship, reasonable grounds to assume the specified information is known, no likely high risk, no complex processing, large amounts of data or sensitive data, and no other recipients, third-country transfers or Article 22 decisions. [18 June Council text, proposed Article 13(5), pp. 109⁠–⁠110]

Article 22 retained the right-not-to-be-subject formulation and the three grounds. It deleted the human-alternative phrase from the operative contractual ground while retaining it in recital 38, and preserved safeguards on human intervention and special-category data. [18 June Council text, recital 38, p. 29; proposed Article 22, pp. 110⁠–⁠111] The relocation means that the operative deletion alone cannot show rejection of the proposition.

Joint rapporteurs’ draft. The Commission’s addition about the purpose of an access request was removed, and the controller’s burden of demonstrating excessiveness was restored. The individual would also receive the choice between paying the fee and refusal. [Joint draft report, Amendments 48⁠–⁠49, pp. 36⁠–⁠37] The rights-based formulation of Article 22 was similarly restored. Amendment 53 specified meaningful human review by a person with the authority, knowledge and competence to change the decision, considering all relevant data. [Joint draft report, Amendments 51 and 53, pp. 37⁠–⁠39]

July MEP amendments. The alternatives for access requests differ over the evidence needed to establish abuse:

• Irena Joveva and colleagues’ Amendment 1076 would delete the proposed replacement of Article 12(5), retaining the existing provision. [Amendments 1053–1260, Amendment 1076, p. 25]
• Julie Rechagneux and colleagues’ Amendment 1087 would specify examples of abusive conduct, including obtaining commercially sensitive information, exerting pressure in unrelated proceedings and disproportionate disruption. Their Amendment 1088 would separately protect good-faith checks of GDPR compliance and assistance under Article 80. [Amendments 1053–1260, Amendments 1087⁠–⁠1088, pp. 31⁠–⁠32]
• Pernando Barrena Arza’s Amendment 1093 would protect requests made in support of other legitimate rights, including employment, consumer and journalistic purposes. It would reject breadth alone as proof of excessiveness and require an assessment based on objective, documented circumstances. [Amendments 1053–1260, Amendment 1093, p. 34]

The transparency alternatives range from deletion to a broader exemption. Joveva and colleagues’ Amendment 1100 would delete the proposed Article 13(4) replacement. Gregorová’s Amendment 1103 would preserve the already-has-information route and add a conditional route for SMEs or organisations with fewer than 250 employees. Among its requirements are contractual necessity, no duty to appoint a DPO, exclusion of Article 9 and 10 data, and continuing availability of information. Wechsler and colleagues’ Amendment 1106 would instead add impossible or disproportionate effort, taking account of the controller’s size and resources, and permit transmission connected with the specified relationship, subject to its other exclusions and safeguards. [Amendments 1053–1260, Amendment 1100, pp. 38⁠–⁠39; Amendment 1103, pp. 40⁠–⁠42; Amendment 1106, pp. 44⁠–⁠45] A size-based rule, a low-risk relationship rule and an effort-based rule would relieve different controllers.

For automated decisions, Agius Saliba’s Amendment 1149 would delete the human-alternative phrase from the article. Its justification links the relocation to the authorities’ recommendation. Kaljurand and colleagues’ Amendment 1150 would make the same operative deletion. [Amendments 1053–1260, Amendments 1149⁠–⁠1150, pp. 78⁠–⁠79] The location of the clarification and the quality of human review remain separate negotiating questions.

September Presidency compromise. Article 12(5) would require the controller to demonstrate reasonable grounds for believing that a request is manifestly unfounded, excessive or reflects abusive intent, taking all relevant circumstances into account. [3 September Council text, proposed Article 12(5), pp. 114⁠–⁠115] Any fee would have to be proportionate to administrative costs, and a refusal would have to give reasons. [3 September Council text, proposed Article 12(5), p. 115] The June text required demonstration that the request itself was manifestly unfounded or excessive. [18 June Council text, proposed Article 12(5), p. 109] The September reasonable-belief formulation may lower the evidential threshold. Article 57(4), by contrast, would continue to require a supervisory authority to demonstrate the manifestly unfounded or excessive character of requests made to it, with abusive intent given as an example. [3 September Council text, proposed Article 57(4), p. 123]

Proposed Article 13(5) would excuse the information duties in paragraphs 1–3 where there are reasonable grounds to assume the person already has the specified information, or where providing information requires disproportionate effort and the processing is likely to create low risk. A further impossibility alternative appears in brackets. [3 September Council text, proposed Article 13(5), pp. 115⁠–⁠116] The exception would exclude complex operations and processing of large amounts of personal data. An exclusion for Article 9 and 10 data is also bracketed. [3 September Council text, proposed Article 13(5), p. 116] The September text would remove the June text’s direct-relationship condition and the categorical exclusions concerning other recipients, third-country transfers and Article 22 decisions. It would also extend the exemption to paragraph 3. [18 June Council text, proposed Article 13(5), pp. 109⁠–⁠110] [3 September Council text, proposed Article 13(5), pp. 115⁠–⁠116] Recital 36 still explains the exception through direct, circumscribed and foreseeable relationships. [3 September Council text, recital 36, pp. 30⁠–⁠31]

Article 22 would retain a right not to be subject to solely automated decisions with legal or similarly significant effects, subject to contractual necessity, authorisation by law or explicit consent. It would preserve human-intervention safeguards and restrictions on special-category data. [3 September Council text, proposed Article 22, pp. 116⁠–⁠117] The clarification that a human alternative does not itself defeat contractual necessity remains in recital 38, continuing the June text’s allocation between recital and article. [18 June Council text, recital 38, p. 29; proposed Article 22, pp. 110⁠–⁠111] [3 September Council text, recital 38, p. 32] The recital still refers to Article 22(2)(a), where the contractual ground sits in the GDPR as it stands. The amended article moves that ground to Article 22(1)(a). [3 September Council text, recital 38, p. 32; proposed Article 22(1)(a), p. 116] The Commission proposal used the same cross-reference. [Commission proposal, recital 38 and proposed Article 22(1)(a)]

2 October proposed mandate. Article 12(5) now confines the abusive-intention ground to requests under Article 15. [2 October Council text, proposed Article 12(5), pp. 120⁠–⁠121] The burden is also split. The controller would have to demonstrate that a request is manifestly unfounded, as under the June text. For excessiveness or abusive intention, reasonable grounds to believe, in light of all relevant circumstances, would remain enough. [2 October Council text, proposed Article 12(5), p. 121] [18 June Council text, proposed Article 12(5), p. 109] Recital 35 is revised to match the limitation to access requests. [2 October Council text, recital 35, pp. 33⁠–⁠34] The lower threshold therefore now applies only where a controller relies on excessiveness or, for an access request, abusive intention.

Article 13(5) is narrower than on 3 September. The exemption from paragraphs 1–3 would apply only where there are reasonable grounds to believe that the person already has the information in points (a) and (c) of paragraph 1 and the processing is not likely to result in a high risk within the meaning of Article 35. [2 October Council text, proposed Article 13(5), p. 121] The two conditions are cumulative. The disproportionate-effort and low-risk alternative and the bracketed impossibility alternative are gone, and the exclusion for Article 9 and 10 data is no longer bracketed. Complex processing and large amounts of data remain excluded. [2 October Council text, proposed Article 13(5), p. 121] [3 September Council text, proposed Article 13(5), pp. 115⁠–⁠116] Recital 36 now states the same conditions. [2 October Council text, recital 36, pp. 34⁠–⁠36] The June text’s direct-relationship condition and its exclusions for other recipients, third-country transfers and Article 22 decisions are not restored. The exemption still extends to paragraph 3. [2 October Council text, proposed Article 13(5), p. 121]

Article 22 and recital 38 are unchanged in substance from 3 September, including the recital’s reference to Article 22(2)(a). [2 October Council text, recital 38, p. 37; proposed Article 22, pp. 122⁠–⁠123]

The AI provisions address two separate legal problems. One concerns reliance on legitimate interests, while the other concerns residual special-category data that cannot readily be removed. Successive texts have changed both the available routes and the safeguards attached to them.

My November 2025 assessment. In my response to the leaked text, I identified a difficult question for open-weight models. If compliance depends on preventing later disclosures, the available safeguards may be limited once others control the model. Whether a particular release could satisfy the condition depends on the applicable safeguards.

Commission proposal. Proposed Article 88c concerns reliance on legitimate interests under Article 6(1)(f). Proposed Article 9(2)(k), read with new paragraph 5, concerns the separate restrictions on special-category data. [Commission proposal, Article 3(3) and (15), proposed Articles 9(2)(k), 9(5) and 88c]

Article 88c would expressly recognise that necessary processing for AI development and operation may pursue legitimate interests. It would preserve the balancing test, the relevance of children’s interests and other laws requiring consent. It would also specify safeguards, including data minimisation and an unconditional right to object. [Commission proposal, proposed Article 88c] The stronger objection right would go beyond an ordinary Article 21(1) objection, under which a controller may establish compelling overriding grounds or a need relating to legal claims. Recital 31 also envisages respecting technical indications embedded in a service that limit third-party use of data for AI development. [Commission proposal, recital 31] These provisions would clarify parts of the legitimate-interest framework without creating a general exemption or prescribing a complete technical opt-out protocol.

The proposal also recognises that a developer may try to exclude health, political or other sensitive information from a large training corpus and still encounter residual examples. It would require organisational and technical measures to avoid special-category data, removal when such data is identified, and effective protection against output or disclosure where removal would require disproportionate effort. [Commission proposal, proposed Article 9(5) and recital 33]

EDPB–EDPS Joint Opinion. The authorities recommended explaining possible reliance on legitimate interests in a recital. They welcomed the unconditional right to object and recommended placing it in Article 21, while separately seeking clarification of enhanced transparency. [EDPB–EDPS opinion, paras 39⁠–⁠43 and footnote 47]

The authorities generally welcomed the special-category derogation and acknowledged that, for models such as general-purpose AI models, controllers cannot always avoid residual and incidental processing. [EDPB–EDPS opinion, para 46] They recommended stating “incidental and residual” processing in the enacting terms, excluding special-category data collected through prompts during deployment, and making the fallback depend on deletion being impossible or disproportionate after a properly documented effort. [EDPB–EDPS opinion, paras 48⁠–⁠50] The Council texts took up all three points, although only the May text put the documentation requirement in Article 9(5) as well as in recital 33. [21 May Council text, proposed Articles 9(2)(k) and 9(5), recital 33] The June and September texts keep it in recital 33 alone. [18 June Council text, proposed Article 9(5), p. 108] [3 September Council text, proposed Article 9(5), p. 114; recital 33, pp. 25⁠–⁠26]

My March 2026 comments. In my comments for the International Center for Law & Economics, I supported both AI provisions. [ICLE comments, sections II.H.1⁠–⁠II.H.2] I argued that Article 88c would change the starting point of the analysis, because authorities could no longer treat the legitimacy of AI training itself as an open question, and that it could usefully be supplemented by more specific criteria. [ICLE comments, section II.C.3] Necessity, in my view, should be assessed by categories of data and dataset-selection criteria rather than record by record. [ICLE comments, section II.D] I also argued that requiring consent for all publicly available data would entrench incumbents with large datasets. [ICLE comments, section II.C.2] I described the unconditional right to object as the central safeguard in Article 88c, operating prospectively by excluding an objector’s data from future training runs. [ICLE comments, section II.G] On Article 9(2)(k), I argued that perfect ex ante filtering is technically impossible, so that without the derogation controllers would have to guarantee perfect exclusion or abandon AI training in the EU. [ICLE comments, section II.F]

May Presidency compromise. Article 88c was deleted, while a statement about possible legitimate interests was retained in recital 33a. The recital omitted the proposed enhanced-transparency and unconditional-objection wording. General GDPR information duties and objection rights would remain applicable. [21 May Council text, recital 33a and Article 3(15), Article 88c (deleted)]

The special-category derogation was narrowed to incidental and residual processing. Its recital distinguished that situation from deliberately processing sensitive data because it is necessary for the purpose, which still requires another applicable Article 9 route or other Union-law provision. Recital 33 also expressly excluded special-category data collected through prompts during deployment. [21 May Council text, recital 33] The derogation would thus address residue in AI development under specified safeguards, with an express limit on its use for deployment inputs. [21 May Council text, proposed Articles 9(2)(k) and 9(5), recital 33]

June Presidency compromise. The recital-only legitimate-interest approach was retained and Article 88c remained deleted. [18 June Council text, recital 33a and Article 88c (deleted), p. 120] For residual special-category data, the June text would allow protective measures instead of erasure where removal is technically impossible or requires manifestly disproportionate effort. [18 June Council text, proposed Article 9(5), p. 108]

Irish Presidency discussion note. The replacement of Article 88c with a recital was expressly described, and governments were asked whether the resulting text offered sufficient certainty. [Irish discussion note, section 2] The recital approach would leave the general Article 6(1)(f) route available, while removing both the proposed operative clarification and some express safeguards.

July MEP amendments. The special-category amendments range from deletion to expansion. Marina Kaljurand and colleagues’ Amendment 1022 would delete Article 9(2)(k). Julie Rechagneux and colleagues’ Amendment 1024 would extend it beyond AI to innovative systems or technologies necessary for a controller’s or third party’s legitimate interests, while retaining paragraph 5’s conditions and adding AI Act qualifications. [Amendments 777–1052, Amendments 1022 and 1024, pp. 155⁠–⁠156] These alternatives concern the separate Article 9 prohibition, even though the latter also refers to legitimate interests.

Salla and colleagues’ Amendment 1025 would confine Article 9(2)(k) to incidental and residual processing, while naming development, training, testing, deployment and operation, including improvements and related products or services. Article 9(5)’s conditions would remain. [Amendments 777–1052, Amendment 1025, pp. 156⁠–⁠157] The shared wording on incidental and residual processing leaves the scope of covered stages and activities contested.

Joveva and colleagues’ Amendment 1051 would tighten Article 9(5). Sensitive data identified in training datasets would have to be erased without undue delay before training ends. For an already trained system or model, the alternative would apply where erasure is technically impossible, with documentation, supervisory notification and protective filtering or alignment. [Amendments 777–1052, Amendment 1051, pp. 172⁠–⁠173] This would substitute technical impossibility for the Commission’s disproportionate-effort test. The amendment would also exclude sensitive data originating from information supplied by, or generated through the activity of, end users on online platforms or core platform services. Its exclusion would apply across development, training and operation. [Amendments 777–1052, Amendment 1051, p. 173] That differs from the May recital’s exclusion of deployment prompts in both the data covered and the relevant processing stages. [21 May Council text, recital 33]

The amendments to Article 88c also differ. Alex Agius Saliba’s Amendment 1553 would delete the article as a whole, while his Amendment 1577 would separately delete paragraph 2’s AI-specific safeguards and leave paragraph 1 intact. [Amendments 1261–1564, Amendment 1553, pp. 168⁠–⁠169] [Amendments 1565–1740, Amendment 1577, pp. 10⁠–⁠11] Rechagneux and colleagues’ Amendment 1569 would generalise paragraph 1 beyond AI to processing necessary for a controller’s or third party’s legitimate interests. It would retain case-by-case assessment and reject a presumption of lawfulness. [Amendments 1565–1740, Amendment 1569, p. 6] Axel Voss’s Amendment 1566 would retain the Article 6(1)(f) structure and general balancing test, remove the specific emphasis on children, and narrow the express carve-out for laws requiring consent to Union laws. [Amendments 1565–1740, Amendment 1566, pp. 3⁠–⁠4]

The additional objection right attracts several alternatives. Jana Nagyová and colleagues’ Amendment 1585 would substitute a reference to Article 21. Schenk and colleagues’ Amendment 1587 would remove the express objection clause while retaining other measures and enhanced transparency. Salla and colleagues’ Amendment 1589 would retain an express right to object but remove “unconditional”. [Amendments 1565–1740, Amendment 1585, p. 18; Amendment 1587, pp. 19⁠–⁠20; Amendment 1589, p. 21] Henrik Dahl’s Amendment 275 would remove the recital passage on technical indications along with additional safeguards and unconditional-objection language. [Amendments 251–400, Amendment 275, pp. 24⁠–⁠25]

My July 2026 assessment. My July update described amendments ranging from deletion to expansion of the AI provisions. I identified the special-category derogation as potentially the Commission proposal’s most directly consequential positive change. My argument was that large-scale training cannot guarantee the perfect exclusion of sensitive information despite filtering efforts.

German drafting suggestions. Germany’s written suggestions on the June text, circulated on 17 August, would have restored an operative Article 88c. [German drafting suggestions, pp. 1⁠–⁠2] Processing for the training and technical operation of an AI system or model “shall be presumed as a legitimate interest”, while the exception for overriding interests or fundamental rights of the data subject, particularly a child, would remain. [German drafting suggestions, proposed Article 88c(1), p. 2] A second paragraph would presume that reusing data collected for other purposes is compatible with the initial purposes, subject to appropriate safeguards. [German drafting suggestions, proposed Article 88c(2), p. 2] Paragraph 1 would not apply to processing specifically directed at identified or identifiable people, to systems designed to identify, monitor or evaluate people, or to systems designed to generate a particular person’s voice, image or other characteristics. Public authorities performing their tasks would also be excluded. [German drafting suggestions, proposed Article 88c(1) and (3), pp. 2⁠–⁠3] The draft would strike the Commission’s list of AI safeguards, including the unconditional right to object. [German drafting suggestions, proposed Article 88c(4), p. 3] Articles 14 and 16 to 18 would not apply where compliance proves impossible or disproportionate. The controller would instead have to publish information before training, explain how to object or seek rectification, and apply available measures against disclosure or identification afterwards. [German drafting suggestions, proposed Article 88c(6), p. 3] Neither presumption appears in the 3 September text. [3 September Council text, proposed Article 88 bis, p. 127]

September Presidency compromise. The September text reintroduced an operative provision on AI legitimate interests as Article 88 bis. It would recognise that development and operation may pursue a controller’s or third party’s legitimate interest under Article 6(1)(f), while requiring the controller to select an appropriate Article 6 basis. [3 September Council text, proposed Article 88 bis(1)⁠–⁠(2), p. 127] Its requirement for technical and organisational measures and safeguards would apply whichever Article 6 basis is used. [3 September Council text, proposed Article 88 bis(3), p. 127] The article would leave the ordinary legitimate-interest assessment in place and create no presumption of lawfulness. The Commission’s detailed AI safeguards, enhanced-transparency language and unconditional objection right are absent. [Commission proposal, proposed Article 88c] [3 September Council text, proposed Article 88 bis, p. 127] Recital 33a continues to address children’s interests and laws requiring consent. [3 September Council text, recital 33a, pp. 26⁠–⁠27]

Article 9(2)(k) uses “unintentional and residual” processing and would retain the development and technical-operation scope. [3 September Council text, proposed Article 9(2)(k), p. 113] Article 9(5) would require measures to avoid special-category data and erasure without undue delay when it is identified. Where erasure is technically impossible or requires disproportionate effort, protective measures would have to prevent further processing, other uses, output or disclosure. [3 September Council text, proposed Article 9(5), p. 114] Removing the June text’s “manifestly” would ease the stated effort condition. The operative trigger now identifies data in datasets used for development, including training, validation and testing, while deleting the June text’s express reference to data in an AI system or model. [3 September Council text, proposed Article 9(5), p. 114] Recital 33 still addresses memorised model data and the difficulty of re-engineering a model. [3 September Council text, recital 33, pp. 25⁠–⁠26] The recital was also revised on 3 September. Its first paragraph now describes special-category data that “unintentionally and residually” exist in training, testing or validation data sets, and its fallback no longer requires “manifestly” disproportionate effort. [3 September Council text, recital 33, pp. 25⁠–⁠26] Its second paragraph still limits the derogation to “incidental and residual processing” and refers to use beyond “incidental or residual existence”. [3 September Council text, recital 33, pp. 25⁠–⁠26] The recital therefore uses both formulations, while Article 9(2)(k) uses only the new one.

The recital would exclude sensitive data directly acquired by or provided to an AI system or model during deployment. It also distinguishes residual processing from deliberate processing of sensitive data necessary for the purpose, for which another Article 9 route is needed. [3 September Council text, recital 33, pp. 25⁠–⁠26] The relationship between the recital and the dataset wording remains open, particularly for model-held residue.

Second Irish draft, reported 21 September. MLex reports that the later AI legitimate-interest language removes “where appropriate” and an express reference to laws requiring consent. It also reports that controllers would still have to select an appropriate Article 6 basis and apply safeguards. [Tar and Newman on later Irish draft, p. 1] In the 3 September text, both phrases appear only in recital 33a, because Article 88 bis strikes the Commission’s corresponding wording. [3 September Council text, recital 33a, p. 26; proposed Article 88 bis(1), p. 127] The reported deletion therefore appears to concern the recital. The EDPB and EDPS had argued that “where appropriate” would “decrease rather than increase legal certainty” because Article 6(1)(f) already requires a necessity test. [EDPB–EDPS opinion, para 41] The report does not discuss the separate residual special-category-data provision.

2 October proposed mandate. Article 88 bis keeps its legitimate-interest statement and its requirement to choose an appropriate Article 6 basis. Paragraph 3 now adds that the required safeguards include “the right to object under Article 21”. [2 October Council text, proposed Article 88 bis, pp. 132⁠–⁠133] The reference is to the existing right. Under Article 21(1), a controller may continue legitimate-interest processing after an objection by demonstrating compelling legitimate grounds or a need relating to legal claims. The Commission’s unconditional objection right is not restored. [Commission proposal, proposed Article 88c] [GDPR, Article 21(1)]

Recital 33a still contains “where appropriate” and the reference to Union or national laws requiring consent. [2 October Council text, recital 33a, p. 31] The 2 October text therefore does not reflect the deletion MLex reported for the later draft. The recital now refers to the development and “operation”, rather than “deployment”, of an AI system or model. It adds three statements. Public authorities may rely on Article 6(1)(e) when they develop, including training, or operate an AI system or model for a public task. Safeguards include respecting data minimisation when selecting sources. The development and operation of AI do not in themselves constitute a legitimate interest, and the applicability of Article 6(1)(f) is assessed case by case by reference to the underlying purpose. [2 October Council text, recital 33a, p. 31] The last statement makes explicit that Article 88 bis establishes no presumption of lawfulness.

The special-category provisions return to the vocabulary that the EDPB and EDPS recommended. Article 9(2)(k) now covers “incidental processing of residual data, where not intended by the controller”. [2 October Council text, proposed Article 9(2)(k), p. 120] [EDPB–EDPS opinion, paras 48⁠–⁠50] Article 9(5) uses “incidentally and residually”, restores “manifestly” disproportionate effort and extends the trigger to datasets used for the development “of and technical operation of” the system or model. [2 October Council text, proposed Article 9(5), p. 120] Recital 33 now uses “incidentally and residually” and “manifestly disproportionate effort” as well. [2 October Council text, recital 33, pp. 30⁠–⁠31] The inconsistency between the article and the recital noted above is therefore resolved. The fallback is again harder to reach than under the 3 September wording. The operative text still refers to datasets rather than to data retained in a model, while recital 33 continues to discuss memorised data.

The negotiations have moved away from splitting terminal-equipment rules between the GDPR and ePrivacy Directive. The remaining questions concern which activities qualify for consent exemptions, how their data may be used and whether browsers should convey automated choices.

My November 2025 pre-proposal assessment. In my response to the leaked text, I called for terminal-integrity protection to target specific risks more precisely. I also gave reasons to retain targeted protections, including device security and protection against state-mandated incursions.

Commission proposal. Rules for storing or accessing personal data in terminal equipment would move into a new GDPR Article 88a. The rules for non-personal data would remain in ePrivacy. [Commission proposal, proposed Article 88a and Article 5] Classifying information as non-personal would therefore not necessarily remove the consent requirement for accessing it.

The proposed GDPR provision would include exemptions for communications transmission, a service explicitly requested by the user, aggregated audience measurement for the controller’s own use, and specified security purposes. It would also provide for easy refusal and a six-month period before asking again for the same purpose after refusal. [Commission proposal, proposed Article 88a(1)⁠–⁠(4)] The own-use audience-measurement wording raises a practical question about services supplied by an outside analytics provider. [Commission proposal, proposed Article 88a(3)(c)]

Article 88b would require interfaces to recognise automated choices and would impose obligations on browser providers outside the SME category. It would also include a media-service-provider exception and a standardisation mechanism. [Commission proposal, proposed Article 88b(1)⁠–⁠(7)] These choices would determine which services would have to accept signals, whose software would convey the user’s decision and how that decision would map onto particular purposes. The SME exception would exclude smaller browser providers from the duty to supply a choice mechanism, while the media exception concerns whether a receiving service would have to respect the signal.

My November 2025 response. In Europe is not “so back”, I argued that the proposal would leave cookie consent banners in place because it retained consent rules for non-personal information and privacy enforcers would interpret the analytics and security exemptions narrowly. My examples included standard third-party analytics and advertising-fraud prevention.

EDPB–EDPS Joint Opinion. The authorities warned that dividing the framework between two instruments would add complexity and uncertainty. [EDPB–EDPS opinion, para 97] They also recommended a consent exception for contextual advertising, subject to conditions. [EDPB–EDPS opinion, para 104 and footnote 107] They described such advertising as based on a single page visit or search query, with no retention or link to past or future activity, while noting that it often relies on “capping cookies, advertising audience measurement cookies, or cookies to combat click fraud”. [EDPB–EDPS opinion, para 104] The authorities also said that they “strongly welcome” proposed Article 88b and recommended changes to its scope, standards and media exception. [EDPB–EDPS opinion, paras 108⁠–⁠116]

My March 2026 comments. In my comments for the International Center for Law & Economics, I described the ePrivacy provisions as the weakest part of the proposal. [ICLE comments, section III.A] I argued that splitting device-access rules between GDPR Article 88a and ePrivacy Article 5(3) would create perverse incentives. [ICLE comments, sections III.C.1 and III.G.1] The exemption list should at a minimum include advertising-fraud detection, basic advertising measurement, frequency capping and contextual advertising, with exemptions turning on risk characteristics and safeguards rather than labels. [ICLE comments, section III.G.2] The analytics exemption should cover third-party providers acting as processors. [ICLE comments, section III.G.3] I warned that browser signals could become a one-way ratchet if regulators gave refusals broad effect while dismissing automated consent as insufficiently specific. [ICLE comments, sections III.C.4 and III.G.4] I also proposed empowering the Commission to add or modify exemptions by delegated act, drawing on the United Kingdom’s approach. [ICLE comments, sections III.D and III.G.5]

May Presidency compromise. The consent framework in ePrivacy Article 5(3) was retained and the exceptions were adjusted. A browser-signals mechanism remained in a renumbered provision. [21 May Council text, amendments to Article 5(3) ePrivacy and proposed GDPR Article 88a] The audience-measurement exception expressly contemplated a third party acting with or on behalf of the service provider. It called for anonymous, aggregated information, while recital 44 described restrictions on combining and sharing the data. [21 May Council text, proposed Article 5(3)(c) ePrivacy and recital 44] The security exception mentioned fraud but tied the exemption to the security of the interface or terminal equipment. [21 May Council text, proposed Article 5(3)(d) ePrivacy] Peter Craddock argued that this might fail to cover fraud against the broader service. [Craddock on ePrivacy]

Council negotiating comments. In national comments compiled on 4 June, Denmark questioned the removal of an earlier exemption for measuring contextual advertising. France supported an ePrivacy exemption. The Czech Republic proposed conditions for contextual advertising, ad-display limitation, audience measurement and audience-fraud prevention. [June national comments, France, p. 238; Czech Republic, pp. 239⁠–⁠241; Denmark, p. 242]

June Presidency compromise. The proposed freestanding fraud exception was struck from ePrivacy Article 5(3) and the parallel provision of the regulation on the processing of personal data by the Union institutions, bodies, offices and agencies (Regulation (EU) 2018/1725, EUDPR). The surviving security clauses referred to technical security and no longer expressly mentioned fraud. [18 June Council text, proposed EUDPR Article 37(4)(d)⁠–⁠(e), p. 127, and ePrivacy Article 5(3)(c)⁠–⁠(d), p. 130]

Irish Presidency discussion note. The reference compromise no longer included the proposed centralised and automated cookie-consent provision, but it did include an extended whitelist under ePrivacy Article 5(3). Ireland asked governments for views on that list and the wording of each purpose. [Irish discussion note, section 4]

July MEP amendments. The tabled amendments offer different architectures. Tomas Tobé, Arba Kokalari and Jörgen Warborn’s Amendment 1371 would replace Article 88a(1)’s consent-only wording with processing under the GDPR on an Article 6 basis. [Amendments 1261–1564, Amendment 1371, p. 76] Alex Agius Saliba’s Amendment 1382 would instead require non-consensual access and subsequent processing to be strictly necessary for the listed purposes. [Amendments 1261–1564, Amendment 1382, p. 82]

Ondřej Krutílek’s Amendment 1404 would add contextual advertising, ad-display limitation, audience measurement and audience-fraud prevention. Its conditions would exclude processing likely to pose a risk to rights and freedoms, profiling, retention beyond active use and links to past or future activity. [Amendments 1261–1564, Amendment 1404, p. 93] Those conditions resemble the earlier Czech proposal, although the evidence does not establish their authorship or transmission. [June national comments, Czech Republic, pp. 239⁠–⁠241] François-Xavier Bellamy’s Amendment 1409 would add a separate exception for detecting, preventing or mitigating fraud and money laundering, and combating terrorist financing. [Amendments 1261–1564, Amendment 1409, pp. 95⁠–⁠96]

Markéta Gregorová and Damian Boeselager, for the Greens/EFA group, proposed a different architecture in Amendments 1365 and 1725. The first would delete GDPR Article 88a. [Amendments 1261–1564, Amendment 1365, pp. 73⁠–⁠74] The second would replace the proposed ePrivacy disapplication with rules for terminal-equipment information generally. Their ePrivacy text would permit non-consensual access only where strictly technically and solely necessary for listed purposes, with conditions on audience measurement and security updates. It would also provide for single-click refusal, limit repeat requests, bar denial of access over unnecessary storage or access, and apply the Article 88b signal mechanism. [Amendments 1565–1740, Amendment 1725, pp. 132⁠–⁠135]

The automated-choice mechanism is equally contested. Angelika Niebler and Monika Hohlmeier’s Amendment 1444 would delete Article 88b. Moratti, Salini and Martusciello’s Amendment 1448 would also delete it, arguing that the mechanism would strengthen dominant undertakings and gatekeepers. [Amendments 1261–1564, Amendments 1444 and 1448, pp. 115⁠–⁠116] That competition concern is the amendment’s stated case rather than an established market effect.

Gregorová and Boeselager’s Amendment 1535 would expand the provider duty from non-SME browsers to browsers, applications and operating systems. It would add withdrawal and permit default refusal or objection signals. [Amendments 1261–1564, Amendment 1535, pp. 158⁠–⁠159] Their Amendment 1540 would require a covered DMA gatekeeper to enable structurally and economically independent third parties to convey individual choices. The duty would be limited to the access needed to convey those choices. [Amendments 1261–1564, Amendment 1540, p. 162]

The media exception also divides MEPs. Gregorová and Boeselager’s Amendment 1498 would delete it, distinguishing consent-exempt audience measurement from permission to disregard signals. Salla and colleagues’ Amendment 1505 would expand it to all processing by or on behalf of a media service provider connected with providing the service. Her Amendment 1506 would give specific consent expressed directly to a controller precedence over a conflicting automated signal. [Amendments 1261–1564, Amendment 1498, pp. 138⁠–⁠139; Amendments 1505⁠–⁠1506, pp. 141⁠–⁠142] These alternatives would separately determine which providers would have to offer controls, whether independent software could carry choices and when a website could depart from a received signal.

My July 2026 assessment. My July update welcomed Ireland’s reopening of the consent exemptions. I described three broad alternatives in Parliament. These were applying ordinary GDPR rules, expanding the exceptions or restricting them.

September Presidency compromise. The terminal-equipment rules would remain in ePrivacy Article 5(3), covering information generally. Proposed GDPR Articles 88a and 88b were still deleted in the September text, including the browser-signals mechanism. [3 September Council text, Articles 88a⁠–⁠88b (deleted), pp. 124⁠–⁠127; ePrivacy Article 5(3), pp. 136⁠–⁠138] The retained consent procedure would provide for single-click refusal and at least six months before another request for the same purpose after refusal. [3 September Council text, ePrivacy Article 5(3), p. 138] The architecture follows the July reference compromise while revising the exempt purposes.

The exemptions would provide three measurement routes:

• Ordinary service analytics. Point (c) would cover storage or access and same-purpose processing solely related and strictly necessary to create anonymous, aggregated information about use of the requested service. The provider or a third party acting on its behalf could perform the measurement. Collected data could not be shared with third parties or combined with third-party data under this exception. [3 September Council text, ePrivacy Article 5(3)(c), p. 137] Recital 44d would permit sharing anonymous aggregate results, while barring further processing for another purpose and combination with data from the provider’s other services or from third parties. [3 September Council text, recital 44d, pp. 38⁠–⁠39]
• EMFA audience measurement. Point (d) would cover measurement complying with Article 24 of the European Media Freedom Act. Personal data would have to be pseudonymised immediately, and material shared beyond parties acting jointly with or on behalf of the provider would have to contain no personal data. [3 September Council text, ePrivacy Article 5(3)(d), p. 137] The recital contemplates independent measurement and joint controllers, with restrictions on reuse. [3 September Council text, recital 44d, p. 39]
• Contextual-advertising measurement. Point (f) would cover measuring the display and performance of advertising based solely on the immediate content of one page or a single search query. It would require no profiling, data retention or link to past or future user activity. Measurement could be conducted jointly or by a third party on the provider’s behalf. [3 September Council text, ePrivacy Article 5(3)(f), p. 137]

Recital 44f lists capping and click-fraud cookies as examples of contextual-advertising measurement. [3 September Council text, recital 44f, p. 40] Its examples and conditions follow the EDPB–EDPS text almost word for word. [EDPB–EDPS opinion, para 104] Cross-visit frequency capping sits uneasily with the prohibition on retention and links to past activity. The tension was already present in the authorities’ formulation. Recital 44g would require a separate GDPR basis for another processing purpose and describes limits on reliance on legitimate interests. [3 September Council text, recital 44g, p. 40] Permission to measure an advertisement therefore supplies no automatic basis for targeting or profiling.

The contextual exception is narrower in its stated activities than the Czech proposal and Amendment 1404, which also name contextual advertising itself, ad-display limitation and audience-fraud prevention. [June national comments, Czech Republic, pp. 239⁠–⁠241] [Amendments 1261–1564, Amendment 1404, p. 93] [3 September Council text, ePrivacy Article 5(3)(f), p. 137] A freestanding fraud-prevention exception remains absent, and the security exception would be confined to technical security of the relevant service means or terminal equipment. [3 September Council text, recitals 44e⁠–⁠44f, pp. 39⁠–⁠40; ePrivacy Article 5(3)(e)⁠–⁠(f), p. 137]

The parallel Union-institutions rule refers to aggregated information; the September text removed “anonymous” from that clause but retained the word in the ePrivacy clause. [3 September Council text, EUDPR Article 37(4)(c), p. 134; ePrivacy Article 5(3)(c), p. 137] The two formulations require separate assessment.

Second Irish draft, reported 21 September. MLex reported tighter conditions for measuring contextual-advertising performance, including pseudonymisation after collection and a prohibition on reuse, and a proposed Commission review of privacy-enhancing technologies for device access. [Tar and Newman on later Irish draft, p. 2] Both appear in the 2 October text.

September privacy-signals campaign. The 10 September Kill the Cookie Banner campaign, involving noyb, BEUC and EDRi, sought restoration of automated privacy signals as a simplification for individuals. [Kill the Cookie Banner campaign, campaign announcement] EDRi’s later intervention contrasts the Council’s continued deletion of that mechanism with its proposed expansion of consent exemptions. [EDRi September commentary, And somehow cookie banners survive] The deletion is established in the 3 September text and maintained on 2 October. [3 September Council text, Articles 88a⁠–⁠88b (deleted), pp. 124⁠–⁠127] [2 October Council text, Articles 88a⁠–⁠88b (deleted), pp. 129⁠–⁠132]

2 October proposed mandate. The architecture is unchanged. Device-access rules remain in ePrivacy Article 5(3), and GDPR Articles 88a and 88b, including the browser-signals mechanism, remain deleted. [2 October Council text, Articles 88a⁠–⁠88b (deleted), pp. 129⁠–⁠132; ePrivacy Article 5(3), pp. 141⁠–⁠143] The revisions concern the exempt purposes, repeat requests and a review clause.

• Ordinary service analytics. Point (c) adds that data collected to create the aggregated information may not be processed for another purpose, alongside the existing bars on sharing and combination. [2 October Council text, ePrivacy Article 5(3)(c), p. 142]
• EMFA audience measurement. Point (d) now requires pseudonymisation “after collection” rather than “immediately after collection”. It adds that the data may not be processed for another purpose and that the processing may not involve tracking the user outside the service or the media content being measured. [2 October Council text, ePrivacy Article 5(3)(d), p. 142] The measurement now has its own recital, which adds decisions on advertising allocation and pricing to its stated purposes. [2 October Council text, recital 44e, p. 43]
• Contextual-advertising measurement. Point (f) now refers to content displayed on the user’s online interface “during an individual visit”, rather than to a single web page. The data retention condition is gone. Instead, measurement may not involve profiling or processing of data relating to past or future activity, “including activity across sites or services”, and the collected data must be pseudonymised after collection and not processed for another purpose. [2 October Council text, ePrivacy Article 5(3)(f), p. 142]

The contextual-advertising recital now names capping cookies and advertising measurement cookies. It no longer mentions cookies to combat click fraud, and it describes pseudonymisation as “a key security measure”. It also excludes the use of the data for profiling or programmatic advertising. [2 October Council text, first recital 44g, p. 44] Frequency capping across visits still requires a count of earlier impressions, which sits uneasily with the bar on processing data about past activity. Removing the click-fraud example also narrows the activities the recital describes. A freestanding fraud exception remains absent. [2 October Council text, ePrivacy Article 5(3)(e)⁠–⁠(f), p. 142]

After a refusal, the provider may not ask again for the same purpose for at least four months, rather than six. [2 October Council text, ePrivacy Article 5(3), p. 143] Recital 45 adds that a new request may be made within that period where it is necessary, for example because the purpose changes, a new service is offered or the service changes substantially, or because the record of the user’s choice has become invalid for reasons outside the provider’s control, such as deleted cookies. It also says that the amendments should not be understood as setting conditions relating to media service providers’ online revenue streams. [2 October Council text, recital 45, pp. 45⁠–⁠46]

A new paragraph in ePrivacy Article 18 would require a Commission report, within a period still in brackets, reviewing the use of privacy-enhancing technologies for device access, with a view to incentives and legal certainty for providers deploying them, and proposals where appropriate. [2 October Council text, ePrivacy Article 18, p. 143] Recital 44 adds that such technologies can support data minimisation and data protection by design. [2 October Council text, recital 44, p. 41] The review would create no consent exception by itself.

The reform would define scientific research while expanding several forms of flexibility for qualifying processing. The principal disputes concern commercial and commissioned research, the relationship between compatibility and legal basis, and the scope of transparency relief.

Commission proposal. The proposed definition has consequences for purpose compatibility, storage, information duties and restrictions on individual rights. The associated safeguards, particularly Article 89(1), would remain part of the framework. [Commission proposal, proposed Article 4(38), Article 5(1)(b), Article 13(5) and recitals 28, 29, 32 and 37] [EDPB–EDPS opinion, paras 26⁠–⁠32]

The definition would expressly include research that can support innovation and acknowledge that it may further a commercial interest. It would also require a contribution to knowledge or a novel application of knowledge, an aim of contributing to society’s general knowledge and wellbeing, and adherence to ethical standards. [Commission proposal, Article 3(1)(b), proposed Article 4(38)] Commercial product development would still need to satisfy those conditions.

Further processing for scientific research would be compatible with the initial purposes independently of Article 6(4)’s compatibility conditions, subject to Article 89(1). [Commission proposal, proposed Article 5(1)(b) and recital 29] Recital 32 expressly recognises legitimate interests for research. [Commission proposal, recital 32] These propositions address purpose compatibility and a possible legal basis separately.

Proposed Article 13(5) would excuse individual information where providing it proves impossible, involves disproportionate effort under Article 89(1)’s conditions and safeguards, or would render the research impossible or seriously impair it. Appropriate protections, including making information publicly available, would remain required. Recital 37 explains the difficulty of contacting people when later research was not anticipated at collection. [Commission proposal, proposed Article 13(5) and recital 37]

EDPB–EDPS Joint Opinion. The authorities welcomed a definition but recommended placing methodological standards, autonomy and independence, and verifiable and transparent results in the operative text. They regarded support for innovation and commercial interest as context rather than useful criteria for distinguishing scientific research. Their reasons included the risk of excluding humanities or social-science research that does not fit an innovation-based description. [EDPB–EDPS opinion, paras 26⁠–⁠29 and footnote 38]

The authorities asked for clearer treatment of the relationship between compatibility and the original legal basis. [EDPB–EDPS opinion, paras 30⁠–⁠32] They supported the recital’s recognition of possible legitimate interests, subject to the GDPR’s other conditions. [EDPB–EDPS opinion, para 35]

May Presidency compromise. The commercial and innovation language was moved into recital 28, while autonomy, independence, methodology and verifiable results appeared in the definition. The recital still contemplated commercial research, so the operative criteria would not create a blanket exclusion. They did create a question about how proprietary and collaborative research would satisfy the conditions. [21 May Council text, proposed Article 4(38) and recital 28]

Published commentary. Mark Leiser’s criticism is that those criteria may fit private R&D and public–private collaborations poorly, producing classification uncertainty rather than a clear ban. [Leiser on research] A pharmaceutical sponsor and an independent academic laboratory can both conduct rigorous research, but their funding arrangements, publication control and commercial objectives differ. Leaving “independence” undefined may make qualification depend on a regulator’s view of those arrangements rather than on the research method.

June Presidency compromise. Recital 28 said that autonomy and independence do not exclude research mandated and conducted by public authorities or private entities, including SMEs, in academic, industrial or other settings. Under the June text, outcomes could serve public, private or commercial purposes. Controllers would have to assess and substantiate scientific-research status case by case from the activity’s objective characteristics, with Article 89 safeguards. [18 June Council text, recital 28, pp. 20⁠–⁠21] The recital clarified the intended inclusion of private research while retaining the operative criteria.

The Commission’s purpose-compatibility approach was retained with an express reference to appropriate safeguards. [18 June Council text, proposed Article 5(1)(b), pp. 107⁠–⁠108] This addressed whether an existing dataset could be used for a new research purpose. A legal basis and other applicable requirements would remain separate questions.

The research notice exception was moved to Article 13(6) and confined to further research processing by the same controller, where and insofar as the conditions are met. [18 June Council text, proposed Article 13(6), p. 110] This was narrower than the Commission’s reference to research processing generally.

IMCO amendments. Piotr Müller’s Amendment 351 would retain the Commission’s definition conditions and add that private funding, research within a commercial undertaking or later commercial use do not, by themselves, remove an activity’s scientific character. [IMCO amendments 329–532, Amendment 351, pp. 16⁠–⁠17]

July MEP amendments. The joint rapporteurs proposed different definitions. Kaljurand and colleagues’ Amendment 965 would require autonomous and independent research, a methodological and systematic approach, recognised ethical and scientific standards, and evidence-based, testable, transparent and published results. Its stated aims concern public knowledge, the public interest or serving humanity, and it would omit the Commission’s express commercial-interest clause. [Amendments 777–1052, Amendment 965, pp. 115⁠–⁠116] Salla and colleagues’ Amendment 970 would define creative and systematic work to increase knowledge, covering foundational research and investigation directed at a practical objective. It would retain an express allowance for commercial interest and omit an autonomy or independence criterion. [Amendments 777–1052, Amendment 970, p. 119]

Alex Agius Saliba’s Amendment 961 would qualify independence by requiring that research remain free of undue external influence. It would also include methodological, ethical, results and public-knowledge criteria and permit subsequent commercial interests. [Amendments 777–1052, Amendment 961, pp. 112⁠–⁠113] The proposals offer different ways to distinguish scientific work from ordinary commercial processing.

Niebler and Hohlmeier’s Amendment 1008 would make the consequence for legal basis express. Under that amendment, compatible further processing could rely on the initial legal basis without a separate one. [Amendments 777–1052, Amendment 1008, p. 143] Kaljurand and colleagues’ Amendment 283 would remove recital 32’s express recognition of legitimate interests while retaining balancing and Article 89 safeguards. [Amendments 251–400, Amendment 283, p. 33] The first proposal concerns reuse of a basis, while the second would change recital language without deleting Article 6(1)(f).

The research notice exception attracts distinct alternatives. Barrena Arza’s Amendment 1118 would delete it. Joveva and colleagues’ Amendment 1122 would retain a qualified exception for further processing, but exclude commercial product development, advertising, marketing, profiling and training models for commercial deployment. It would also address inability reasonably to obtain contact details, documentation, public information and later notification. [Amendments 1053–1260, Amendment 1118, pp. 54⁠–⁠55; Amendment 1122, pp. 57⁠–⁠58] An activity could qualify as scientific research yet remain outside this particular notice exemption.

September Presidency compromise. The proposed definition would retain methodological and ethical requirements and verifiable, transparent results. It places “in an autonomous and independent manner” in the requirement concerning production of those results. [3 September Council text, proposed Article 4(38), p. 113] The June text placed the phrase earlier, in the description of how research is conducted. [18 June Council text, proposed Article 4(38), p. 107] Recital 28 expressly contemplates public and private research, including SMEs and commercial outcomes, while requiring a case-by-case assessment of objective characteristics. [3 September Council text, recital 28, pp. 22⁠–⁠23]

Further processing for scientific research would be deemed compatible with the initial purposes independently of Article 6(4), subject to appropriate Article 89(1) safeguards. [3 September Council text, proposed Article 5(1)(b), p. 113, and recital 29, pp. 23⁠–⁠24] A controller establishing that the activity qualifies under Article 4(38) would therefore dispense with Article 6(4)’s separate assessment of the relationship between the original and research purposes, the collection context, the data’s nature, possible consequences and safeguards. [3 September Council text, proposed Articles 4(38) and 5(1)(b), p. 113] [GDPR, Article 6(4)(a)⁠–⁠(e)] A weak connection between the purposes would not, by itself, defeat compatibility.

The processing would still require a valid Article 6 basis and, where applicable, an Article 9 condition. [GDPR, Articles 6 and 9] Whether the original legal basis can support the further processing remains a separate question. The EDPB and EDPS welcomed the compatibility clarification but requested clearer operative rules on when the original basis carries forward. [EDPB–EDPS opinion, paras 30⁠–⁠32] Qualifying AI research could benefit from this route even though Article 88 bis creates no general compatibility presumption for AI. [3 September Council text, proposed Articles 4(38) and 5(1)(b), p. 113, Article 88 bis, p. 127, and recital 33a, pp. 26⁠–⁠27]

Article 13(6) would retain the June text’s limitation to further research processing by the same controller. It would cover impossibility, disproportionate effort or serious impairment of the research objectives. The express Article 89(1) qualification follows the impairment ground, while appropriate protections, including public information, would be required in all cases. [3 September Council text, proposed Article 13(6), p. 116] The broader general exemption in Article 13(5) would create a second possible route. Its disproportionate-effort and low-risk alternative has no same-controller or further-processing limitation, although complex operations and large amounts of data would be excluded and the Article 9 and 10 exclusion remains bracketed. [3 September Council text, proposed Article 13(5), pp. 115⁠–⁠116]

2 October proposed mandate. Article 4(38) now ends with the sentence “This does not exclude that the research may also aim to further a commercial interest.” [2 October Council text, proposed Article 4(38), p. 119] The Presidency describes this as placing the clarification in the operative text. [2 October Council text, cover note, para 11(iii), p. 5] The sentence restores, in different words, the Commission’s express commercial-interest clause, while keeping the Council’s methodological, ethical, autonomy and independence criteria. [Commission proposal, Article 3(1)(b), proposed Article 4(38)] Commercial research must still meet those criteria. Recital 29 now describes further processing for research as “compatible processing operations”. [2 October Council text, recital 29, p. 28] The 3 September text, like recital 50 of the GDPR, called it “compatible lawful processing operations”. [3 September Council text, recital 29, pp. 23⁠–⁠24] [GDPR, recital 50] The proposed recital therefore no longer describes such processing as lawful in itself, although recital 50 of the GDPR keeps that wording. Recital 28, Article 5(1)(b) and Article 13(6) are unchanged in substance. [2 October Council text, recital 28, pp. 27⁠–⁠28; proposed Articles 5(1)(b) and 13(6), pp. 119 and 122]

The narrower Article 13(5) removes most of the overlap described above. The disproportionate-effort and low-risk alternative is gone, and the remaining exemption requires that the person already have the specified information. [2 October Council text, proposed Article 13(5), p. 121] Research reusing data that individuals do not expect would therefore ordinarily depend on Article 13(6).

The practical-compliance changes combine reporting relief with EU-wide instruments and revised allocations of responsibility. Their effect depends on both the substantive thresholds and which institution controls lists, templates and methodology.

Commission proposal. Supervisory authorities would be notified of breaches likely to result in high risk, within 96 hours of awareness where feasible and without undue delay. Compared with the existing Article 33 threshold and 72-hour period, this would reduce the class of notifiable breaches and extend the outer reporting period. The obligation to document breaches would remain, and 96 hours is an outer period rather than a waiting period. [Commission proposal, proposed Article 33(1) and recital 39]

Notification would pass through the proposed NIS2 single-entry point, with direct reporting to the competent supervisory authority until it is established. [Commission proposal, proposed Article 33(1)⁠–⁠(1a)] The EDPB would prepare a common notification template and a list of circumstances likely to create high risk. The Commission could adopt them by implementing act. [Commission proposal, proposed Article 33(6)⁠–⁠(7)]

For data protection impact assessments (DPIAs), common lists would identify operations requiring and not requiring an assessment, accompanied by a common template and methodology. The EDPB would propose the materials and the Commission could adopt them by implementing act. Existing national lists would remain valid until that act. [Commission proposal, proposed Article 35(4)⁠–⁠(6c)]

The separate biometric-verification derogation would be conditional on the individual’s sole control of the biometric data or the means needed for verification. [Commission proposal, proposed Article 9(2)(l)] The provision concerns verification and would not extend to biometric identification generally.

EDPB–EDPS Joint Opinion. The authorities supported the higher breach threshold and longer reporting period. [EDPB–EDPS opinion, paras 73 and 77] They cautioned that a common submission channel does not align the triggers, deadlines or content of every reporting obligation and called for clarity about how the regimes interact. [EDPB–EDPS opinion, paras 78⁠–⁠87] They also welcomed the direction of the biometric-verification derogation but recommended attention to less intrusive alternatives. [EDPB–EDPS opinion, paras 36⁠–⁠38]

June Presidency compromise. The high-risk threshold and 96-hour period were retained. [18 June Council text, proposed Article 33(1), p. 112] A national entry point under proposed NIS2 Article 23b replaced the Commission’s single-entry point, while the transitional route was preserved. The competent data-protection authority would remain the destination. [18 June Council text, proposed Article 33(1)⁠–⁠(1a), p. 112]

The EDPB would establish and publish the breach template and lists covering both high-risk and non-high-risk circumstances. The Commission could adopt the template by implementing act. [18 June Council text, proposed Article 33(6)⁠–⁠(7a), pp. 112⁠–⁠113] For DPIAs, the EDPB would establish the lists, template and methodology within nine months and review them at least every three years. National lists would remain until the replacements were established. The Commission’s optional implementing role was confined to the template. [18 June Council text, proposed Article 35(4)⁠–⁠(6c), pp. 113⁠–⁠114]

The June text would also extend data-protection-by-design and default duties to processors for their own obligations and offered means and services. [18 June Council text, proposed Article 25, pp. 111⁠–⁠112; recital 39a, p. 31] It would remove the duty to communicate DPO contact details to the supervisory authority. [18 June Council text, Article 37(7), p. 114]

Joint rapporteurs’ draft. The high-risk threshold and 96-hour period were retained. [Joint draft report, Amendment 54, p. 39] The draft also followed the June text’s distinction between EDPB materials and an optional Commission act for the breach template. [Joint draft report, Amendments 56⁠–⁠57, pp. 40⁠–⁠41] It followed the same allocation for DPIA lists, template and methodology. [Joint draft report, Amendments 58⁠–⁠63, pp. 41⁠–⁠44]

July MEP amendments. Kaljurand and colleagues’ Amendment 1183 would return to an ordinary-risk threshold and 72 hours. [Amendments 1053–1260, Amendment 1183, p. 120] It would reverse both elements retained in the joint draft and September Presidency compromise. Gregorová’s Amendment 1221 would provide for a Commission decision giving general validity to the EDPB’s DPIA lists, template and methodology. [Amendments 1053–1260, Amendment 1221, pp. 143⁠–⁠144] This would give the Commission a role beyond the June text’s template-only implementing power.

September Presidency compromise. Article 33 would retain the high-risk threshold and 96-hour period, subject to notification without undue delay. [3 September Council text, proposed Article 33(1), p. 118] Reporting to the competent supervisory authority would take place “with the support of” the national entry point, replacing the June text’s “via” wording. [18 June Council text, proposed Article 33(1), p. 112] [3 September Council text, proposed Article 33(1)⁠–⁠(1a), p. 118] The supporting role would preserve direct notification until the entry point is established.

The EDPB would establish and publish breach lists covering circumstances likely and unlikely to create high risk. It would submit a proposed notification template for possible Commission adoption by implementing act. [3 September Council text, proposed Article 33(6)⁠–⁠(9), pp. 118⁠–⁠119] Recital 39 says the lists should also guide communication of breaches to individuals under Article 34, while the operative Article 34 text remains unchanged. [3 September Council text, recital 39, pp. 32⁠–⁠33]

For DPIAs, the EDPB would retain the positive and negative lists, while the Commission could adopt both the common template and methodology by implementing act and review the Board’s proposal as necessary. [3 September Council text, proposed Article 35(4)⁠–⁠(6b), pp. 119⁠–⁠121] This would extend the Commission’s role under the June text to methodology while leaving selection of listed processing operations with the EDPB. The accompanying changes to Articles 64 and 70 would replace the national draft-list consistency procedure with Board tasks. [3 September Council text, amendments to Articles 64 and 70, pp. 123⁠–⁠124] National lists would remain valid until the Board established replacements. [3 September Council text, proposed Article 35(6c), p. 121]

Article 25 would retain the direct processor duties that the May text added and the June text kept. [21 May Council text, proposed Article 25 and recital 39a, pp. 15⁠–⁠16 and 32⁠–⁠33] [18 June Council text, proposed Article 25, pp. 111⁠–⁠112; recital 39a, p. 31] [3 September Council text, proposed Article 25, pp. 117⁠–⁠118; recital 39a, p. 33] These duties would affect product settings, service configuration and the allocation of work under processing contracts. The September text removed the June amendment concerning DPO contact details, so the existing publication and communication requirements would remain. [18 June Council text, Article 37(7), p. 114] [3 September Council text, Article 37(7) amendment (deleted), p. 121]

New recital 40b says that transfers relying on Article 49(1)(a)–(g) need not be non-repetitive. It expressly contemplates repetitive or systematic transfers necessary for important reasons of public interest under point (d). [3 September Council text, recital 40b, p. 35] The operative Article 49 text remains unchanged. The September text’s reference to systematic transfers supports a broader reading where the public-interest purpose makes them necessary, but the relationship with the existing occasionality language still requires interpretation. The necessity conditions and recognition of the public interest in Union or Member State law remain relevant. [Article 49 guidelines, pp. 8⁠–⁠11]

Second Irish draft, reported 21 September. MLex reported an ENISA information point that would identify reporting duties and direct organisations to national entry points without receiving incident reports itself. It attributed the approach partly to concerns about routing firms subject to the Digital Operational Resilience Act (DORA) away from their usual supervisors. [Tar and Newman on later Irish draft, p. 2] The information point already appears, as proposed NIS2 Article 23a, in the 3 September text and is retained on 2 October. [3 September Council text, proposed NIS2 Article 23a] [2 October Council text, proposed NIS2 Article 23a, pp. 144⁠–⁠145] MLex also reported a clarification of data-protection-authority supervision under the Data Act where personal data are concerned. [Tar and Newman on later Irish draft, p. 2] Recital 26a of the 2 October text now says that the authorities supervising the GDPR should monitor the application of the Data Act insofar as the protection of personal data is concerned. [2 October Council text, recital 26a, p. 23]

2 October proposed mandate. Articles 25, 33 and 35 are unchanged in substance from 3 September. The high-risk threshold and 96-hour period remain, as do the allocation of breach and DPIA materials between the EDPB and the Commission. [2 October Council text, proposed Articles 25, 33 and 35, pp. 123⁠–⁠126]

Recital 40b is narrower. It now says that transfers under Article 49(1), points (d) and (f) to (g), need not be non-repetitive, rather than points (a) to (g). [2 October Council text, recital 40b, p. 40] The reference to “systematic” transfers is gone, and transfers necessary for important reasons of public interest now include, as an example, international data exchange between tax administrations. [2 October Council text, recital 40b, p. 40] The Presidency’s cover note names that example. [2 October Council text, cover note, para 11(iii), p. 5] Removing “systematic” weakens the support for the broader reading discussed above. The recital still leaves Article 49 unchanged.

A new point (c) in Article 97(2) would have required the Commission’s periodic GDPR evaluation to examine Chapter IV, on controllers and processors. The evaluation would have addressed the proportionality of those obligations and whether they should be further adapted to the level of risk for data subjects and their impact on smaller organisations. [2 October Council text, proposed Article 97(2)(c), p. 133] Agence Europe reports that Germany had sought a category of low-risk controllers exempt from several GDPR obligations. [Agence Europe on the 7 October plan] [Agence Europe on the postponed vote] It reports that the Presidency text omits that category and provides for this review instead. [Agence Europe on the 7 October plan]

21 October Council mandate. The agreed mandate replaces that point with a new Article 97(5a). Within six months of the amending Regulation’s entry into force, the Commission would issue a dedicated report with recommendations on Chapter IV. The report would address the proportionality of the obligations for small and medium-sized enterprises and non-commercial organisations undertaking low-risk processing, and whether those obligations should be amended in light of the level of risk for data subjects. [Council mandate · 22 October text, proposed Article 97(5a), p. 146] The report no longer waits for the periodic evaluation, and it uses the low-risk criterion of the German proposal as Agence Europe reported it. It still creates no exemption. Its effect depends on whether the Commission follows its recommendations with a legislative proposal.

The enforcement debate concerns who should define common criteria and what legal consequence should follow when an organisation applies them. The September compromise and the Council mandate would assign substantial work to the EDPB while preserving narrower Commission powers, but neither offers a strong presumption for compliance with pseudonymisation guidance.

My February 2025 proposal. In A serious target for improving EU regulation: GDPR enforcement, I argued that the enforcement structure favours privacy-maximalist interpretations and leaves insufficient room for other rights and economic interests. I proposed keeping investigation with data protection authorities while assigning consequential and cross-border decisions to an independent EU tribunal. Its membership would include economists, business experts and generalist judges, and it would review EDPB guidance and opinions.

My April 2025 assessment. In GDPR reform: what should it achieve, I reiterated that an agenda focused on recordkeeping would miss the structural enforcement problem.

Commission proposal. Article 41a would allow the Commission to adopt implementing acts specifying when pseudonymised data is no longer personal for particular entities. The EDPB would give an opinion on the draft, and Member States would participate through the examination procedure. [Commission proposal, proposed Article 41a(1), (4) and (5)] This allocates final adoption differently from reliance on EDPB guidance alone.

Paragraph 3 would give compliance with the criteria a limited evidential role. It could be used as an element demonstrating that data cannot lead to reidentification. The provision would create neither conclusive compliance nor a rebuttable presumption, and would supply no general immunity from enforcement. [Commission proposal, proposed Article 41a(3)]

EDPB–EDPS Joint Opinion. The authorities opposed Article 41a partly because the criteria affect the reach of data-protection law and should, in their view, remain within the framework of independent supervisory authorities. [EDPB–EDPS opinion, paras 22⁠–⁠25] They asked whether compliance would create a rebuttable presumption or merely supply one factor among others, and recommended deleting the provision. [EDPB–EDPS opinion, paras 24⁠–⁠25]

My March 2026 comments. In my comments for the International Center for Law & Economics, I argued that compliance with Article 41a criteria should create a rebuttable presumption of non-identifiability. [ICLE comments, sections I.G and I.H.3] I called enforcement reform the missing piece of the package. [ICLE comments, section IV] My proposals included a published proportionality assessment before the EDPB adopts guidelines, opinions or recommendations, formal consultation duties, and review of EDPB guidance by an independent tribunal before it takes effect. [ICLE comments, sections IV.D and IV.F.2⁠–⁠IV.F.3]

May Presidency compromise. Article 41a was replaced with Article 29a. [21 May Council text, Article 3(10), proposed Article 29a]

June Presidency compromise. Article 29a combined an operative provision on the entity-relative effect of pseudonymisation with an EDPB opinion procedure. It excluded processors from that entity-relative provision and deleted the Commission implementing-act machinery. [18 June Council text, proposed Article 29a(2)⁠–⁠(5), pp. 115⁠–⁠116]

Joint rapporteurs’ draft. The compliance amendments concerned Articles 33, 35 and 70, as discussed in the practical-compliance section. They left Article 41a unchanged. [Joint draft report, Amendments 56⁠–⁠67]

EDPB anonymisation guidelines. The July guidelines accepted entity-relative anonymity but attached qualifications that make the test operationally difficult to use. [Anonymisation guidelines, paras 6⁠–⁠10, 15, 20⁠–⁠22 and 32⁠–⁠35] The personal-data section examines their treatment of processors, onward disclosure and effective separation.

IMCO amendments. Piotr Müller’s Amendment 398 would replace Article 41a(3)’s evidential rule with a presumption that data will not lead to reidentification where the implementing act’s means and criteria are implemented. Its justification calls this a rebuttable presumption of compliance, but the operative text states a presumption about non-reidentification rather than compliance with the GDPR generally. [IMCO amendments 329–532, Amendment 398, p. 46] The amendment belongs to IMCO’s draft-opinion procedure.

July MEP amendments. Kaljurand and colleagues’ Amendment 1244 would delete Article 41a. Ondřej Krutílek’s Amendment 1255 would retain Commission implementing acts and clarify non-personal status for entities not reasonably likely to identify the person. [Amendments 1053–1260, Amendments 1244 and 1255, pp. 160 and 169]

Salla co-signed Amendment 1289 with Oliver Schenk and colleagues. It would retain the rule that implementing the criteria could be used as an evidential element, adding references to technical and organisational measures and non-reidentification in a specific case. [Amendments 1261–1564, Amendment 1289, pp. 17⁠–⁠18] This differs both from deletion and from Müller’s proposed presumption.

Francesco Torselli’s Amendment 1287 proposed a stronger legal consequence for a narrower setting. Within a group of undertakings, pseudonymised data would cease to constitute personal data for an undertaking meeting specified conditions. Binding arrangements and effective technical and organisational measures would have to prevent access, or reasonably likely access, to identifying information held elsewhere in the group, prohibit reidentification attempts and rule out other reasonably likely identification means. The undertaking would have to demonstrate that those arrangements and measures work. [Amendments 1261–1564, Amendment 1287, p. 16] This is a conditional rule about personal-data status rather than an evidential presumption.

My July 2026 assessment. My July update acknowledged the EDPB’s acceptance of entity-relative anonymity but argued that its qualifications made the guidance difficult to apply. I treated this as evidence of an institutional inability to provide the practical guidance needed. I supported Commission powers capable of producing guidance with legal force and strong presumptions of lawful behaviour.

September Presidency compromise. Article 25a would give an express legal consequence to a recipient’s inability to identify an individual, but leave the decisive assessment to the standards of reasonably likely means and identification that is insignificant in practice. [3 September Council text, proposed Article 25a(2)⁠–⁠(3), pp. 121⁠–⁠122] Controllers would remain responsible for determining and demonstrating the result, with guidance supplied through an EDPB opinion. [3 September Council text, recital 27c, p. 22; proposed Article 25a(6)⁠–⁠(7), p. 122]

The allocation of powers differs elsewhere in the reform. The EDPB would establish EU-wide DPIA lists, while the Commission could adopt the common template and methodology by implementing act on the basis of the Board’s proposal and review it as necessary. [3 September Council text, proposed Article 35(4)⁠–⁠(6b), pp. 119⁠–⁠121] Article 25a would retain the EDPB opinion route for pseudonymisation and anonymisation. [3 September Council text, proposed Article 25a(6)⁠–⁠(7), p. 122] Recital 40a calls for national guidance to be consistent with EDPB guidance and says that consistent application should contribute to Union innovation and competitiveness. [3 September Council text, recital 40a, p. 34]

2 October proposed mandate. The operative Article 25a no longer contains the “insignificant in practice” standard. Recital 27b now explains when a third party should not be considered to have reasonably likely means of identification. [2 October Council text, recital 27b, p. 26; proposed Article 25a(5), p. 127] Controllers remain responsible for determining and demonstrating that pseudonymised data do not lead to re-identification, and the EDPB opinion remains the source of further guidance. [2 October Council text, recital 27c, p. 26; proposed Article 25a(6)⁠–⁠(7), p. 127] Paragraph 7 still refers to the opinion “referred to in paragraph 4”, although the opinion provision is paragraph 6. [2 October Council text, proposed Article 25a(7), p. 127] Commission implementing criteria and any presumption attached to compliance remain absent. The DPIA allocation and recital 40a are unchanged in substance. [2 October Council text, recital 40a, p. 39; proposed Article 35(4)⁠–⁠(6c), pp. 125⁠–⁠126] The mandate agreed on 21 October keeps this position, including the paragraph 7 cross-reference. [Council mandate · 22 October text, proposed Article 25a(5)⁠–⁠(7), pp. 140⁠–⁠141]