EU Council proposes easing data protection rules for AI training

The Council of the European Union has reached an agreement to amend the General Data Protection Regulation (GDPR) to facilitate the use of personal data for the development and deployment of artificial intelligence.

As part of the Digital Omnibus negotiation mandate, the agreement introduces a new Article 88bis. This provision would allow the processing of personal data for AI purposes to be classified as lawful under the basis of legitimate interest, potentially removing the requirement for explicit user consent. Additionally, the Council proposes a narrower definition of personal data, suggesting that identifiers such as IP addresses, tracking IDs, and social security numbers may no longer fall under strict GDPR requirements.

The move has faced criticism from privacy advocates. Max Schrems of the organization noyb has voiced opposition, noting that the regulations could affect individuals who have never been customers of the processing companies and encompass extensive historical datasets.