The EU’s data-reform debate trades easier AI training against meaningful control over personal data

Netzpolitik’s 6 October examination of the Council’s 2 October Data Omnibus draft identifies an AI-specific route for processing personal data on a legitimate-interest basis rather than obtaining consent, subject to conditions. An objection right was added, but several governments disputed the departure from technology-neutral rules. These details describe a negotiating draft, not enacted EU law.

The same report finds that mandatory machine-readable privacy preferences had fallen out of the Council text. Instead, cookie refusals would have to be respected for four months. A browser setting could communicate a consistent choice across services; repeated site-by-site choices leave that work with the individual. Simplification for businesses and simplification for users need not produce the same design.

A second dispute concerns pseudonymisation. EDRi’s analysis explains why substituting an identifier for a name does not necessarily remove the person from the data: advertising and device identifiers can still connect behaviour across services and support targeting. It objects to treating the same information as personal for one holder but outside GDPR protections for another judged unable to identify the person.

That distinction matters beyond AI training. Privacy protections can become dependent on which organisation holds a dataset, even while the dataset remains useful for singling someone out. EDRi is an advocacy organisation opposing the changes; its argument identifies the legal consequence it fears, rather than establishing what courts would ultimately decide.

The unresolved design question is who must do the work: the company establishing a justified use, or the individual discovering the use and objecting. Calling either arrangement less bureaucratic does not settle whose control improves.