In a joint opinion published on Wednesday 11 February, the two European data protection authorities, the EDPB and the EDPS, strongly criticize the European Commission’s proposed revision of the GDPR, which they consider to be a considerable weakening of protection standards (see EUROPE 13755/4).
In its simplification package presented in November, the Commission proposed a number of changes to the regulation on personal data, including two that quickly became controversial: changes to the definition of personal data, with the amendment of Article 4, and the use of data pseudonymisation, with the addition of a new Article 41(a).
A number of NGOs, MEPs and Member States see this amendment to the GDPR as a risky precedent and fear that greater flexibility in the name of competitiveness could pave the way for a gradual dilution of personal data protection guarantees (see EUROPE 13757/9). Described by the Noyb organisation as “the greatest invasion of privacy in years”, this proposal has provoked an impressive outcry from civil society (see EUROPE 13776/14).
This is a fear that the two European authorities seem to share: “We strongly urge the co-legislators to not adopt the proposed changes to the definition of personal data. These changes are not in line with the Court’s case law and would significantly narrow the concept of personal data. We must make sure that any changes to the GDPR and EUDPR actually clarify obligations and bring legal certainty while maintaining trust and a high level of protection of individual rights and freedoms”, warned European Data Protection Supervisor Wojciech Wiewiórowski.
The authorities expressed more support for the other provisions of the ‘omnibus’ simplification package. They say they are in favour of using certain personal data to train AI models (see EUROPE 13795/8) and support measures to reduce ‘consent fatigue’ by revising the rules on cookies and the proliferation of ‘banners’.
See the joint opinion: https://aeur.eu/f/kos (Original version in French by Isalia Stieffatre)