EU governments have agreed their position on the #DigitalOmnibus on Data, and AI is at the heart of it.
Under the Irish Presidency, the Council has joined a deregulation project built around a dangerous idea: that Europe’s AI ambitions require feeding an ever-growing appetite for data, even if that means weakening rights people already have.
1 Boost
0 Likes
The text does not change the definition of personal data but makes it easier for the #GDPR to stop applying along a data chain.
The Council wants to make the protection of pseudonymised data (gentle reminder: still personal data) depend much more on who holds them.
In today’s huge data chains and distributed internet where almost nobody (except the biggest players) has a reliable overview of everybody else’s capabilities, the same information can pass through websites, platforms, cloud providers, analytics companies and data brokers, all with very different abilities to link it back to a person.
That means GDPR protection could effectively disappear halfway down the chain, together with people’s rights and safeguards, even though another actor further along may have far greater ability to identify, track or single them out.
The Council also makes it easier to process some of our most sensitive data in AI contexts, weakens information duties, makes some access requests easier to reject as ‘abusive,’ and makes it easier to justify decisions taken entirely by machines even when a human could have taken them instead.
Research is another problem.
‘Scientific research’ is defined very broadly while getting easier reuse of data and lighter information duties, risking activities far beyond genuine scientific inquiry benefiting from research exemptions.
On ePrivacy, one important correction: access to our phones, browsers and other devices goes back under Article 5(3) of the ePrivacy Directive, where it belongs.
But the Council still expands consent-free access, lets companies ask again after a refusal, and drops the broader framework for automated, machine-readable privacy signals.
The text gives AI special treatment: personal data processed ‘in the context of the development and operation’ of AI may be carried out for the legitimate interest of a company or third party.
That is extraordinarily broad, covering huge parts of an AI system’s life, from building and training to deployment.