How the Digital Omnibus Could Unravel Europe’s Digital Safeguards

Over the past decade, the European Union has built an extensive legal framework governing the digital environment. The General Data Protection Regulation was followed by the Data Governance Act, the Digital Markets Act, the Digital Services Act, the Data Act and the AI Act. These instruments established the legal rules governing the collection, use and sharing of data, the operation of digital markets and services, and the development and deployment of systems driven by AI.

The framework is now entering a period of both expansion and revision. While the EU continues to introduce new technology legislation (Cloud and AI Development Act proposal, Quantum Act, Action Plan on Cybersecurity and Artificial Intelligence), the Digital Omnibus proposal is reopening central parts of the existing data-protection acquis, including the GDPR.

This double push creates a governance challenge. New legislation increasingly relies on concepts and safeguards developed elsewhere in EU law. Altering a foundational instrument can therefore change the operation of the wider framework, even where an amendment is confined to a single regulation.

Simplification shifts legal burdens

The Commission presents simplification as a route to competitiveness and innovation. The difficulties surrounding the digital acquis also stem from uneven implementation, fragmented enforcement and unresolved interactions between instruments. Reopening foundational rules risks weakening rights without resolving those problems.

The quality of regulation cannot be measured by the number of obligations it removes. Legal certainty, coherence, effective enforcement and the protection of fundamental rights are equally important. The distribution of the remaining burdens also matters. Lifting a controller’s documentation duty may make violations harder for individuals, particularly workers, to prove. Reduced transparency may require supervisory authorities or courts to reconstruct facts that controllers were previously required to record. Narrower legal definitions may exclude certain activities from regulatory scrutiny.

The Digital Omnibus illustrates this dynamic. It reopens several parts of the GDPR, including the definition of personal data, the rules on special categories of data, transparency duties and procedural safeguards. As the European Parliament and the Council develop their positions, these provisions may take different forms in the final compromise. The level of protection will depend on how they operate together. Rights may remain formally recognized, yet their scope or practical enforceability may be reduced.

The effects reach beyond the GDPR

The GDPR is a foundational instrument of the European digital acquis. Its definitions, principles and safeguards are incorporated into, or interact with, legislation governing AI, digital markets, platform work and other data-driven activities. Changes to the definition of personal data, transparency, accountability, automated decision-making or access to remedies may therefore have consequences well beyond the GDPR.

The EU’s Platform Work Directive illustrates how changes to the GDPR could affect the practical exercise of rights established under another instrument. It sets out specific rules on the processing of personal data by automated monitoring and decision-making systems, transparency, human oversight and human review of decisions taken or supported by those systems. The Directive adds more specific and additional protections alongside the GDPR, and its data-protection concepts are interpreted in light of GDPR definitions. Restricting GDPR safeguards concerning access, transparency or automated decision-making would not formally repeal those protections. It could, however, narrow the supplementary information and evidentiary routes available to persons performing platform work and their representatives when seeking to understand or challenge algorithmic management practices.

The same pattern appears elsewhere in the data acquis. The Digital Omnibus would repeal the Data Governance Act, the Open Data Directive and the Free Flow of Non-Personal Data Regulation, transferring relevant provisions into an amended Data Act. This consolidation increases the importance of the distinction between personal and non-personal data, because that classification determines which rights, obligations and enforcement mechanisms apply. Narrowing the GDPR definition of personal data could alter the application of the consolidated data framework and remove some processing activities from the protection of the GDPR.

The AI Act provides another example. It uses concepts derived from EU data-protection law and applies alongside the GDPR where AI systems process personal data. Changes to the treatment of personal or special-category data could alter whether processing connected with AI systems falls within the GDPR and how overlapping obligations apply.

A selective codification of CJEU case law

The Joint Opinion of the European Data Protection Board and the European Data Protection Supervisor supports measures that improve harmonization, consistency and legal certainty. However, it identifies serious concerns about several proposed GDPR amendments. It also notes the absence of a full impact assessment and the limited consideration given to possible adverse effects on fundamental rights.

The proposed amendment to the definition of personal data illustrates the problem. The Commission presents the change as reflecting recent CJEU case law on pseudonymization and identifiability, particularly the judgment in the case EDPS v SRB. The EDPB and EDPS urge the co-legislators not to adopt the amendment. In their view, the amendment generalizes part of the Court’s reasoning in a fact-specific judgment without adequately reflecting either the circumstances of the case or the wider jurisprudence on identifiability. They warn that it would significantly narrow the concept of personal data and create legal uncertainty.

The Court’s judgment contains two linked findings: (1) identifiability must be assessed from the position of the entity concerned; and (2) information that is not personal for that entity may become personal when disclosed to a recipient with means reasonably likely to identify the individual and, in that situation, indirectly for the entity making it available. The Digital Omnibus draws on the first finding but appears to exclude the second. The result, selective codification, may produce a rule narrower than the case law claims to reflect.

The consequences extend well beyond this amendment. The definition of personal data determines the material scope of the GDPR. For the entity concerned, information falling outside that definition is no longer subject to the Regulation’s principles, rights, accountability requirements or supervisory mechanisms. The amendment would narrow the material scope of EU data protection law and could affect other EU acts that rely on the GDPR definition. The EDPB and EDPS also warn that a substantial change could create fragmentation with the Council of Europe’s Convention 108+ and with third-country laws largely aligned with the GDPR’s current definition.

The proposal raises an institutional question. It would insert a new Article 41a into the GDPR, empowering the Commission to specify the means and criteria for determining whether data resulting from pseudonymization no longer constitute personal data for certain entities. The EDPB and EDPS recommend deleting the provision and preserving the role of independent supervisory authorities, subject to judicial control, in applying the GDPR’s definitions.

A new derogation for sensitive data in AI development

The proposed derogation for the incidental and residual processing of special categories of personal data in AI development raises a different concern. The EDPB and EDPS recognize that such processing cannot always be avoided during the training, testing and validation of AI systems. They nevertheless recommend limiting the derogation to genuinely incidental and residual processing, requiring documented efforts to remove sensitive data where possible, excluding data supplied through prompts during deployment, and maintaining safeguards throughout the AI lifecycle.

A narrowly framed derogation may be justified in exceptional circumstances. It should not evolve into a general legal basis for retaining sensitive data whenever compliance becomes difficult or costly.

Foundational legal concepts are not legislative variables

The effectiveness of the GDPR depends on how its substantive and procedural safeguards operate together. They determine whether information falls within the Regulation, which processing is permitted, what must be documented, what individuals can access and contest, what authorities can investigate, and what courts can review.

The Digital Omnibus risks altering essential parts of this protective structure. A narrower definition of personal data could place some processing beyond the GDPR’s reach, leaving data minimization, purpose limitation and accountability inapplicable. A broader derogation could permit special-category data processing that would otherwise be prohibited. Changes to transparency, access rights and procedural safeguards may make processing less visible and infringements harder to prove. In sum, the catalogue of rights may remain intact, but the conditions for exercising them may be significantly weakened.

In conclusion, it is likely that the Digital Omnibus will not remove legal burdens and costs but simply redistribute them. When companies that process personal data have fewer obligations to document and disclose their activities, the associated costs and uncertainty do not disappear. They are transferred to individuals, regulators, and courts, which must do more to detect unlawful processing and pursue remedies.

If that becomes reality, the European data protection ecosystem will be severely damaged, even if the legal framework remains formally unchanged. The key test will be whether, despite the Omnibus, the legislation still makes it possible to identify and challenge unlawful processing. The challenge for the co-legislators is therefore not so much how to simplify Europe’s digital rules, but how to ensure that the foundations that make those rules enforceable remain intact.