EUobserver has published an article on the European Commission's leaked "Digital Omnibus" draft, featuring comments from Gianclaudio Malgieri, Associate Professor at eLaw , on potential implications for the GDPR.
EUobserver reported on a leaked draft of the European Commission's "Digital Omnibus" package, which aims to streamline EU digital regulation. In the piece, Gianclaudio Malgieri, outlines concerns about proposed amendments that could significantly affect the level of protection afforded by the GDPR.
Malgieri noted that the draft includes unexpected and radical changes and 'would be quite (negatively) impactful on the level of protection of personal data under the GDPR'. He highlighted several areas requiring particular attention and caution:
- a move towards a more "relative" definition of personal data;
- a redefinition of special categories of data, potentially excluding certain sensitive inferences (including for the definition of health data);
- an expansion of grounds for automated decision‑making for contractual purposes, even where processing may not be strictly necessary; and
- the inclusion of personal data processing for AI training under the legitimate interest lawful basis, with the possibility of processing sensitive data if it cannot be removed from datasets.
According to Malgieri, any expansion of "legitimate interest" for AI training would require careful balancing and robust safeguards. He suggested that proposed new safeguards-such as enhanced transparency and a strengthened right to object-should be clearly connected to existing substantive rights rather than presented solely as balancing mechanisms.
The draft also proposes that the European Data Protection Board (EDPB) and the European Commission agree on a common template and methodology for Data Protection Impact Assessments (DPIAs), as well as a list of processing operations that should or should not trigger a DPIA. While this could increase clarity and foreseeability, Malgieri cautioned that an overly prescriptive approach might risk reducing DPIAs to a tick‑box exercise.
Finally, although the package is framed as a simplification effort for start‑ups and SMEs, Malgieri observed that the practical advantages may primarily benefit larger companies, especially in the technology sector.
The article can be accessed at the website of EUobsever.
