European Commission Proposes Changes to GDPR: Impact on AI and Cookie Tracking
In a significant move that could reshape data handling practices, the European Commission is gearing up to revise the General Data Protection Regulation (GDPR). This overhaul spans a wide spectrum, from the realm of cookie tracking to the training of AI models. The proposed alterations, as leaked by German advocacy group Netzpolitik.org, are part of the forthcoming “Digital Omnibus” package. This package is poised to eliminate the mandatory requirement for websites to obtain explicit consent before deploying tracking cookies. Additionally, it aims to explicitly authorize AI training on personal data, provided it aligns with companies’ “legitimate interests.”
The draft introduces Article 88a into the GDPR, focusing on the processing of personal data from terminal equipment. By integrating cookie regulations within the GDPR itself, the proposal seeks to streamline operations and reduce compliance costs. This shift from the ePrivacy Directive to the GDPR could revolutionize the approach to cookie usage. In essence, it moves from an opt-in model to an opt-out system, where users are automatically tracked unless they object.
Furthermore, the proposal outlines Article 88b, which mandates browsers or operating systems to transmit user consent preferences automatically. This mechanism, once standardized, could potentially phase out the prevalent cookie banners. Notably, media entities are granted exemptions, allowing them to continue seeking explicit consent due to the preservation of journalism’s economic foundations.
Addressing the contentious issue of AI training using personal data, the draft permits such activities under the umbrella of “legitimate interest.” However, stringent safeguards, including data minimization and transparency, must be implemented. The Commission emphasizes that AI training should benefit both the data subjects and society at large, emphasizing the importance of detecting bias and ensuring accurate model outputs.
Another pivotal change proposed is the narrowing of sensitive data definitions under Article 9 of the GDPR. The revised framework suggests that heightened protections will only apply to data revealing explicit traits like race, religion, or health. This shift has raised concerns among critics, who fear that companies could infer protected characteristics without triggering enhanced legal safeguards.
While these proposed amendments could bring about significant transformations in corporate data governance practices across Europe, they have sparked mixed reactions. Privacy advocates caution against diluting privacy standards, emphasizing the need to uphold fundamental rights protection in any regulatory updates. As the European Commission prepares to unveil the formal proposal on November 19, the tech industry eagerly awaits the potential impact of these regulatory adjustments on data handling practices.
In conclusion, as the European Commission sets the stage for these GDPR revisions, the tech landscape stands on the cusp of a transformative regulatory shift. Balancing innovation with privacy concerns remains a critical challenge, and the outcomes of these proposed changes could reshape the digital landscape for years to come.