EU Digital Omnibus amendments to GDPR to facilitate AI training miss the mark
EU Digital Omnibus amendments to GDPR to facilitate AI training miss the mark
Publish Date: 2026-02-09 09:31:00
Source Domain: iapp.org
- Key amendments to the EU General Data Protection Regulation (GDPR) in the EU Digital Omnibus aim to simplify and facilitate artificial intelligence (AI) innovation, particularly concerning the processing of personal data for training large language models (LLMs).
- The Commission proposes that AI providers may rely on the legitimate interest basis for AI development and operation, provided they apply enhanced safeguards and give data subjects an unconditional right to opt-out.
- The second provision would allow the processing of “residual” special-category data for AI development and operation under a new exemption, provided specific conditions regarding data minimization and removal are met.
- Critics argue that these amendments might introduce more complexities than they resolve, especially the provision of the unconditional opt-out for scraping data from the internet, which they deem practically impossible and undesirable from a data protection perspective.
- The legitimate interest basis is deemed acceptable for using first-party data (user-provided data) subject to certain safeguards, but extending the option to opt-out to scraped third-party data is impractical and undermines effectiveness.
- European Data Protection Authorities have shown alignment in supporting the legitimate interests basis but with necessary safeguards, which the proposed amendments may not sufficiently address.
- There is a distinction between data that is publicly accessible and data that belongs to the public domain, where the former’s use for LLM training can violate original privacy expectations.
- Current AI exemptions are confusing because they do not exclude essential elements of special-category data which, by nature of the LLMs, cannot be effectively removed or shielded from being utilized in outputs.
