The package has barely been introduced, yet already it promises to have a rocky future. The ‘omnibus’ package aimed at simplifying European regulation of the digital sector was only unveiled on Wednesday 19 November (see EUROPE 13755/4, 13755/3) and yet it could already be in for a bumpy legislative ride.
Described as “the biggest attack on privacy rights in years” by the organisation Noyb in their statement published the same day, the proposed simplification of the General Data Protection Regulation (GDPR) has provoked a strong outcry from civil society. For many, the text is about more than simplification: it goes to the very heart of Europe’s digital doctrine.
The Irish Council for Civil Liberties is concerned about potential “misuse by Chinese and US companies” of the concept under GDPR of the legal basis of legitimate interest to train AI models with little oversight. Amnesty International talks of a text that will “pave the way for illegal surveillance, discriminatory profiling (...) and encourage the spread of harmful content online”.
Proposals to simplify the AI Act have not been received any more favourably. EDRi is calling on MEPs and Member States to “reject any weakening”. The Social Democrat group in the European Parliament has also denounced a text that “would recklessly undermine the EU’s digital legal framework” while the Greens/EFA group accuses the European Commission of seeming to “cave under the pressure of the Trump administration and Big Tech lobbies”.
Thierry Breton, former European Commissioner for the Digital Agenda, has also joined the battle. “No one is fooled over the transatlantic origin of these attempts” to dismantle the European regulatory framework, he scoffed.
On the other hand, several professional organisations have given their support to the proposals on the table. The lobby for major digital companies (CCIA Europe), such as Google and Amazon, is even calling for a “more ambitious, all-encompassing review”. The International Association of Privacy Professionals (IAPP) believes that the ‘omnibus’ “responds to long-standing demands from the sector”. And in the European Parliament, the EPP group “welcomed” the project, hoping for its rapid adoption.
On the parliamentary front, the equation promises to be just as tricky. S&D, the Greens and The Left are already planning to reject the European Commission’s proposals. Renew Europe remains divided: the group talks of “major concerns” raised by the package, but is satisfied with certain proposals relating to businesses.
With such a marked division within the ‘von der Leyen’ majority in the European Parliament, it is not out of the question that the omnibus proposal could lead to an alliance between the right and the far right, in the manner of the dossier on corporate due diligence (see EUROPE 13751/1).
In the Council of the EU, changes to GDPR could become a point of friction between the EU27. A number of countries, such as Slovenia, Estonia and Austria, have already made it clear that in their view the GDPR “does not require any further amendments at this time” (see EUROPE 13750/21).
Germany, however, is in favour of this and is taking France along in its wake. The two countries are now forming a united front on the issue of the one-year postponement of certain obligations under the AI Act, taken up by the European Commission in its omnibus (see EUROPE 13754/12).
The legislative package still has to be allocated to the relevant European Parliament committees and will be discussed at EU Council level. In a fragmented political landscape, it risks provoking a long and difficult struggle over the regulatory framework governing the EU’s digital sector. (Original version in French by Isalia Stieffatre)