EU Data Protection Boards Reject Major GDPR Reforms in Digital Omnibus

The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) issued a joint opinion rejecting several core proposals in the European Commission's Digital Omnibus package. They opposed the attempt to narrow the definition of personal data under Article 4(1) of the GDPR, the move to let the Commission decide what qualifies as pseudonymised data, and the draft amendment to Article 12(5) that would restrict data subjects' right of access. While the opinion does not block the proposal on AI training based on legitimate interest, it notes that the new Article 88c remains unclear and would still require a three‑step test for legality. The Digital Omnibus aims to simplify the EU's digital regulatory framework, consolidating measures across the Data Act, NIS2, DORA, AI Act and other instruments, but the most contested changes concern fundamental data‑protection rights.