Key Highlights:
- EU member states approved a negotiating position of GDPR on October 21 that would clarify the use of legitimate interest as a legal basis for processing sensitive data in AI development.
- Privacy advocate Max Schrems called the move digital expropriation, warning it could give AI companies broader access to Europeans personal data without consent.
- The proposal is not yet made into a law. The European Parliament must establish its position before negotiations with the Council and Commission can lead to a final agreement.
European Union administrations have backed a proposed change to the General Data Protection Regulation, GDPR. This could make it easier for AI firms to use personal data to operate their systems without obtaining consent in every case, The part of the EU’s Digital Omnibus package has garnered criticism from privacy advocates who fear that commercial AI development could take priority over individuals’ data rights. Max Schrems, the Austrian privacy lawyer and founder of advocacy group NOYB, described the move as “digital expropriation.” However, the Council’s approval is a negotiating step rather than a final legislative decision, and the proposal still faces scrutiny from the European Parliament.
What GDPR Change Have EU Governments Approved for AI Firms?
On October 21, the Council of the European Union agreed on its position for negotiations over changes to the bloc’s virtual rules. The package includes a proposed GDPR provision covering the development of AI systems and models. The Council’s version would explicitly state that processing personal data in this context may be carried out on the basis of a controller’s or third party’s “legitimate interest” under Article 6(1)(f) of the GDPR.
Legitimate interest in already one of the legal bases available under the GDPR. Companies can depend on it in appropriate circumstances, but they must evaluate whether the processing is necessary and whether the interests of individuals outweigh the interests being pursued. The European Commission has prior explained that organisations cannot use this basis when the impact on people’s rights outweighs their legitimate interests.
:bangbang: EU governments approved a GDPR change to let companies train AI on Europeans’ personal data without consent. It makes AI training a possible "legitimate interest", judged case by case. Parliament must still agree. Max Schrems calls it a "digital expropriation" of Europeans. https://t.co/hCXn3AQMKa
— International Cyber Digest (@IntCyberDigest) October 26, 2026
The proposed change would therefore not simply abolish consent requirements across the board. Instead, it would explicitly recognise legitimate interest as a possible legal basis for processing personal data in AI development and operation. Under the Council’s text, companies would still need to select an appropriate legal basis under Article 6 and apply technical and organisational safeguards to protect individuals’ rights, including the right to object under Article 21.
The dispute centres on whether these conditions would offer meaningful protection when AI companies process large volumes of information collected from online services, social media and other sources. Critics argue that explicitly establishing this legal basis could make it easier for companies to justify using data that individuals originally shared for other purposes.
Why Has Max Schrems Called the Proposal “Digital Expropriation”?
Schrems and NYOB have strongly criticized the Council’s position, arguing that there would be a disproportionate balance between commercial interest and privacy rights in favour of AI companies. NOYB warned that the shift could allow firms to process sensitive data in the context of AI with fewer constraints, potentially affecting information collected over many years. Schrems described the decision as “digital expropriation” of Europeans.
The backlash goes beyond whether AI firms must request consent. NOYB argues that a wide legal basis tied to AI development could make it harder to restrict the purposes for which personal data is used. The group has also raised concerns about the treatment of pseudonymised information, arguing that proposed changes to the definition of personal data could weaken protections for certain data linked to individuals. These are the organisation’s objections to the package, rather than settled interpretations of a law already in force.
EU institutions have framed the broader Digital Omnibus effort as an attempt to simplify regulations and decrease compliance burdens while maintaining data protection standards. The Council says its proposed amendments seek to make the bloc’s digital rulebook clearer and easier to apply. The disagreement shows a broader policy challenge for Europe: how to support AI development and competitiveness without undermining the privacy protections established by the GDPR.
The proposal has not become law. The Council is ready to start negotiations once the European Parliament establishes its position. The final wording will rely on the legislative process, meaning the scope of any change to AI firms’ ability to process personal data remains subject to negotiation.
