The European Commission’s recent move to revise the General Data Protection Regulation (GDPR) has stirred significant debate within the tech and privacy communities. The proposed changes aim to streamline how companies handle personal data, particularly in the realms of AI training and cookie tracking.
Under the leaked draft of the upcoming “Digital Omnibus” package, the Commission intends to relax the stringent requirements for obtaining explicit consent before setting tracking cookies on websites. This shift could signal a move from an opt-in to an opt-out approach, where users would need to actively object to being tracked, rather than giving upfront consent.
Moreover, the proposal seeks to transfer the regulation of cookies from the ePrivacy Directive to the GDPR itself, introducing Article 88a to address the processing of personal data collected through terminal equipment. This change could potentially simplify compliance efforts for businesses by aligning cookie rules with broader GDPR principles.
In the realm of AI, the draft outlines provisions for AI model training under the GDPR’s “legitimate interest” basis. While this could facilitate innovation and development in AI technologies, concerns have been raised regarding the potential for large-scale data processing without individual consent, a departure from the GDPR’s original intent of safeguarding personal data rights.
Additionally, the proposal includes adjustments to the protection of sensitive data under Article 9 of the GDPR, narrowing the scope of data considered sensitive to information directly revealing specific characteristics like race or health. Critics worry that this revision could pave the way for companies to infer sensitive traits from seemingly innocuous data, potentially undermining privacy safeguards.
As the European Commission prepares to unveil the formal proposal on November 19, stakeholders are closely monitoring the implications these changes could have on data governance practices across Europe. While the aim may be to enhance regulatory coherence and reduce compliance burdens, it is essential to strike a balance between facilitating innovation and upholding fundamental data protection rights.
The upcoming unveiling of the Commission’s proposal will likely spark further discussions and scrutiny from privacy advocates, industry experts, and policymakers. As the landscape of data privacy continues to evolve, finding the right equilibrium between fostering technological advancements and safeguarding individual privacy remains a complex yet crucial endeavor.