the General Data Protection Regulation<\/a>, the ePrivacy Directive, the NIS2 Directive and the Data Act. It also reorganises provisions of the Data Governance Act, the Open Data Directive and the Regulation on the free flow of non-personal data.<\/p>\nThe part concerning the AI Act has already been adopted and entered into force on 27 July, while the general proposal remains subject to the EU legislative process.<\/p>\n
Proposed Changes to the GDPR, the AI Act and the Data Act<\/h2>\n
In the field of data protection, one of the most significant changes concerns the definition of personal data. The proposal seeks to ensure that the possibility of identifying an individual is assessed from the specific standpoint of each entity. Accordingly, certain data could be regarded as non-personal data in relation to an organisation where that organisation does not have means reasonably likely to be used to re-identify the data subject.<\/p>\n
The proposal also recognises that legitimate interests may, where appropriate, provide a lawful basis for processing personal data in connection with the development and operation of AI systems. It further provides for a specific regime governing special categories of personal data that may appear incidentally in datasets used for the training, testing or validation of such systems.<\/p>\n
In addition, the proposal would extend to 96 hours the period for notifying certain data breaches, introduce standardised templates for data protection impact assessments and allow cookie preferences to be communicated through automated, machine-readable mechanisms.<\/p>\n
Under the AI Act, the amendments extend certain simplified measures to small mid-cap enterprises, facilitate access to regulatory sandboxes and reduce certain administrative obligations. Furthermore, the requirements applicable to the high-risk systems listed in Annex III will apply from 2 December 2027, while those concerning AI systems embedded in regulated products will apply from 2 August 2028.<\/p>\n
As regards the Data Act, the objective is to consolidate a number of currently fragmented rules within a more coherent framework, facilitate data reuse and reduce the burdens associated with switching cloud service providers.<\/p>\n
Arguments in Favour: Simplifying the Regulatory Burden on Businesses<\/h2>\n
From a business perspective, the Digital Omnibus addresses a genuine practical difficulty. A single incident may trigger notification obligations under the GDPR, NIS2 or DORA, while an AI project may simultaneously be subject to data protection, governance and risk assessment requirements. The establishment of a single reporting point for incidents, together with standardised templates and the harmonisation of key concepts, could reduce duplication and enhance legal certainty.<\/p>\n
The Commission estimates that the package could generate administrative savings of approximately EUR 1.2 billion per year. Nevertheless, simplification does not necessarily amount to better regulation. The European Data Protection Board and the European Data Protection Supervisor have warned that the proposed new definition of personal data could substantially narrow the scope of application of the GDPR.<\/p>\n
The final outcome will therefore depend on whether the EU legislature succeeds in removing unnecessary administrative requirements without weakening essential principles such as transparency, accountability and the effective protection of fundamental rights.<\/p>\n