EU Member States approved a position on Wednesday that would broadly permit companies to process personal data for AI without asking people for consent, according to noyb. The group says the proposed rules would reach people who have never used an AI company’s services, as well as information shared decades earlier in messages or social posts. The measure forms part of the Digital Omnibus proposal, with Germany among the countries supporting the Council’s position, noyb says.
Under noyb’s account of the proposal, companies would be presumed to have a legitimate interest that outweighs users’ rights when processing information for AI use or training. The group says that presumption could extend to any personal information an AI company obtains, rather than being limited to records gathered from its own customers. Those changes remain part of a legislative proposal; the approval described by noyb concerns the Council, which represents Member States.
The Council text calls the provision Article 88bis, replacing the Commission proposal’s Article 88c numbering, according to noyb. The Council also inserted references to GDPR Articles 21 and 24, covering objections in certain circumstances and organisations’ implementation of their legal obligations. But noyb argues those duties already apply and that citing them supplies no additional substantive protection against AI processing.
The Commission presented the Digital Omnibus as limited simplification for EU businesses while promising to preserve strong protections for Europeans, according to noyb. The group says the accelerated process proceeded without an assessment of fundamental rights or direct participation by the European data protection expert group. Ireland currently leads the Council presidency and hosts the EU headquarters of most US and Chinese AI corporations, noyb says.
The Council decision follows earlier criticism of the Irish Presidency’s approach: in September, noyb described a leaked proposal that would automatically treat personal data use for AI as lawful. At that stage, the group reported broad informal support among many Member States for that same general approach.
Max Schrems argues that companies already holding large stores of Europeans’ information would gain most from the change. noyb also warns that EU businesses generally lack comparable data access and financing to compete with US corporations. It says information gathered by EU companies but handled through services or platforms abroad could consequently reach providers based in the US or China.
