The Council of the European Union agreed its negotiating position on the Digital Omnibus on Wednesday, adopting a mandate to simplify parts of the GDPR, modernise the cookie rules in the ePrivacy Directive and consolidate the EU’s data rulebook, while keeping what it called strong levels of protection for personal data. The agreement, reached under the Irish presidency, opens the way for negotiations with the European Parliament once MEPs adopt their own position.
The file is the data half of the Commission’s “Omnibus VII” simplification package, proposed in November 2025. Its companion measure on the implementation of harmonised AI rules was adopted separately on 29 June 2026. Wednesday’s mandate covers data protection, privacy and cybersecurity reporting — and, in a handful of provisions, the data rules AI developers work under.
What The Council Mandate Changes In The GDPR
The mandate keeps the current definition of personal data and adds a new provision on pseudonymisation and the identification of a natural person, aimed at clarifying when pseudonymised data falls inside the rules. It simplifies compliance for unfounded or excessive data requests and for specific low-risk circumstances around information obligations, and it introduces a principle-based definition of “scientific research” with targeted exemptions so research organisations can process personal data under a simplified framework.
Two provisions speak directly to AI. The mandate adds safeguards to a newly proposed derogation allowing the processing of sensitive data for biometric verification and in the context of the development and operation of AI systems, and it clarifies the lawful grounds for processing personal data for AI development, with what the Council called appropriate safeguards. The mandate also backs extending the deadline for notifying personal data breaches, a single EU-level list of processing categories likely to result in high risk, and common templates for regulatory obligations.
Cookies, Data Sharing And One Door For Incident Reports
On cookies, the mandate keeps consent rules under the ePrivacy Directive but widens the purposes for which consent is not required — where a cookie is necessary to provide a service, for audience measurement, or for the security of the user’s device — a change the Council says should reduce the number of cookie banners. The data acquis provisions consolidate rules on data altruism and intermediation services, let public bodies charge very large enterprises and designated gatekeepers higher fees for re-using public sector data, and strengthen trade secret protection: secrets would have to be disclosed only once the data holder and the user have taken all necessary measures to preserve confidentiality.
For cybersecurity, the Council replaced the proposed single EU entry point with a national entry point in each member state, plus an EU-level incident reporting information point and provisions for harmonised, cross-border incident notification.
Why It Matters
The Digital Omnibus position matters to AI companies less for its headline GDPR streamlining than for the direction of travel it confirms. Europe’s rulebook is being rewritten around a simple bargain: keep the rights framework, cut the procedural weight, and write AI development into the data rules explicitly rather than leaving it to regulator interpretation. The sensitive-data derogation for developing and operating AI systems, and the clarification of lawful grounds for AI processing, are the provisions model builders will cite — they move questions that currently depend on national regulators’ readings into the legislative text itself. The trade secret and gatekeeper-fee provisions point the other way, toward a more defensive European data posture for everyone else. What happens next is a negotiation, not a law: the Parliament has not yet adopted its position, and the Council text can move in trilogue. But with the AI-side act already adopted in June and the “One Europe, One Market” roadmap targeting conclusion of all simplification packages by the end of 2027, the simplification direction now has both institutions’ machinery behind it. Our explainers track the framework this package amends: the EU AI Act, explained and AI laws around the world in 2026. A third reference point is the copyright litigation running in parallel in the US courts, where the rules are being written by judges instead.
Background
The Omnibus programme grew out of the October 2024 European Council call to act on the Letta and Draghi competitiveness reports; since February 2025 the Commission has put forward twelve Omnibus packages simplifying existing legislation. The digital package arrived in November 2025, and its path through the Council was not smooth — an earlier compromise failed to win ambassadors’ support on 7 October before the Irish presidency’s revised text, with strengthened trade secret safeguards, secured agreement on 21 October.
Source: Council of the European Union
0 Comments