Regulation / Privacy / AI Governance
EU Council agrees Digital Omnibus negotiating mandate, including GDPR provision on AI processing
Member state ambassadors set the Council's position on rewriting GDPR, Data Act and other digital rules. noyb says the new Article 88bis would treat AI-related processing as lawful by default; Parliament has yet to take its position.
The Council of the EU’s Permanent Representatives Committee agreed a mandate for negotiations with the European Parliament on the Digital Omnibus at its meeting on 21 October 2026. The text amends the GDPR, the Data Act, the AI Act, the ePrivacy Directive and NIS2. It also repeals the Data Governance Act and the Open Data Directive and moves public-sector data reuse into the Data Act.
The Data Act changes include a new ground for refusing data access where trade secrets face a high risk in third countries, the narrowing of business-to-government sharing to ‘public emergencies’ and the deletion of Article 36 on smart contracts.
According to noyb, the Council’s Article 88bis would presume a legitimate interest for processing personal data ‘in the context of AI’. noyb also says it would narrow the definition of personal data for pseudonymised data. Trilogue negotiations will follow once Parliament adopts its position.
Why it matters
If Article 88bis survives trilogues, the lawful basis for AI training and use of historic personal data could shift. DPOs should already know which datasets and AI use cases currently depend on consent or a case-by-case legitimate interest assessment. A narrower definition of personal data would affect how pseudonymised identifiers such as user IDs and tracking IDs are classified in data catalogues and records of processing. Data Act teams should note the proposed trade-secret refusal ground and the narrower public-emergency scope of business-to-government requests.
Status: In negotiation. Council mandate agreed; Parliament has yet to adopt its position
What to check
- Inventory which AI training and AI use cases rely on consent or legitimate interest today, so you can assess the impact if Article 88bis is adopted.
- Identify datasets held only under pseudonymous identifiers, so you can gauge exposure to a narrower personal data definition.
- Review Data Act data-sharing procedures for third-country recipients against the proposed trade-secret refusal ground.
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Institutions
Who should care
- DPO
- Legal & compliance
- AI governance lead
- CDO