{"url":"https://www.euractiv.com/news/council-moves-to-drop-legitimate-interest-legal-basis-for-ai-in-gdpr-proposal/","title":"Council drops AI 'legitimate interest' basis in GDPR plan","domain":"euractiv.com","imageUrl":"https://images.pexels.com/photos/7327876/pexels-photo-7327876.jpeg?auto=compress&cs=tinysrgb&h=650&w=940","pexelsSearchTerm":"EU council meeting","category":"Politics","language":"en","slug":"116b2e46","id":"116b2e46-1cad-4be8-b3c4-b58a731fad37","description":"EU Council proposes removing a specific new provision allowing \"legitimate interest\" as legal basis for personal data processing in AI development under GD","summary":"## TL;DR\n- EU Council proposes removing a specific new provision allowing \"legitimate interest\" as legal basis for personal data processing in AI development under GDPR amendments.\n- A compromise text dated **15 April 2026**, seen by *Euractiv*, follows privacy authorities' view that existing GDPR rules already cover this without new text.[[1]](https://www.euractiv.com/news/council-moves-to-drop-legitimate-interest-legal-basis-for-ai-in-gdpr-proposal)[[2]](https://table.media/assets/berlin/digitalomnibus.pdf)\n- This prioritizes data protection over simplifying AI rules, amid Digital Omnibus talks to ease tech compliance.\n\n## The story at a glance\nThe EU Council, representing member states, issued a compromise on **15 April 2026** in Digital Omnibus negotiations to drop a proposed addition explicitly permitting \"legitimate interest\" (GDPR Article 6(1)(f)) for AI-related personal data processing.[[2]](https://table.media/assets/berlin/digitalomnibus.pdf) This follows **EDPB** and **EDPS** opinions that no new provision is needed, as legitimate interest can already apply case-by-case under current rules.[[3]](https://www.edpb.europa.eu/system/files/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf) The change comes as the EU balances AI innovation with privacy in ongoing trilogues.\n\n## Key points\n- Original Commission Digital Omnibus proposal (late 2025) sought to add **Article 88c GDPR** clarifying legitimate interest for AI model development and operation, with safeguards like right to object.[[2]](https://table.media/assets/berlin/digitalomnibus.pdf)\n- **EDPB/EDPS Joint Opinion 2/2026** (Feb 2026) agreed legitimate interest may work for some AI cases but said it's unnecessary to codify, as their prior Opinion 28/2024 already confirms it under existing GDPR; suggested recital over new article if pursued.[[3]](https://www.edpb.europa.eu/system/files/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf)\n- Council's **15 April compromise** removes this specific AI carve-out, aligning with privacy hawks' caution against easing consent requirements for vast AI training datasets.[[1]](https://www.euractiv.com/news/council-moves-to-drop-legitimate-interest-legal-basis-for-ai-in-gdpr-proposal)\n- Retains other simplifications like derogations for incidental special category data in AI (e.g., Article 9(2)(k) GDPR) and pseudonymisation guidance.\n- Part of broader Digital Omnibus aiming to cut red tape on GDPR, AI Act, Data Act via templates, delayed deadlines, single breach reporting point.\n- No quotes from Council text leaked; *Euractiv* reporting based on document seen by them.\n\n## Details and context\nThe Digital Omnibus, proposed by Commission in late 2025, targets \"competitiveness\" by tweaking GDPR/AI Act burdens post-Draghi report, including AI data use for training without always needing consent.[[4]](https://www.amnesty.org/en/latest/news/2026/04/eu-simplification-laws) Privacy groups warned this risks \"rolling back rights\" by narrowing personal data scope and blanket legitimate interest for AI.[[2]](https://table.media/assets/berlin/digitalomnibus.pdf)\n\nCouncil's move echoes earlier Feb 2026 compromise deleting Commission's narrower \"personal data\" definition, deferring to **EDPB** pseudonymisation guidelines.[[5]](https://www.euractiv.com/news/council-deletes-revised-definition-of-personal-data-from-gdpr-omnibus/) For AI, dropping the provision avoids controversy but keeps general legitimate interest viable via balancing test (necessity vs data subject rights), as EDPB outlined—no automatic opt-out for AI firms.\n\nTrade-off: Slows AI data access (e.g., no explicit nod to bias mitigation as overriding interest) but upholds GDPR's strict consent norm, especially for special data. Earlier leaks showed retention in some drafts, but April text shifts conservative.[[2]](https://table.media/assets/berlin/digitalomnibus.pdf)\n\n## Why it matters\nEU data rules shape global AI norms via \"Brussels effect,\" so retaining caution on legitimate interest signals privacy trumps unchecked training on personal data.  \nAI developers face higher consent hurdles for EU data, raising costs/complexity versus US flexibility, while users gain stronger objection rights.  \nWatch trilogues with Parliament (pro-simplification lean) for final text; outcome likely by mid-2026, before AI Act high-risk rules hit.","hashtags":["#eu","#ai","#gdpr","#dataprotection","#digitalomnibus","#regulation"],"sources":[{"url":"https://www.euractiv.com/news/council-moves-to-drop-legitimate-interest-legal-basis-for-ai-in-gdpr-proposal/","title":"Original article"},{"url":"https://table.media/assets/berlin/digitalomnibus.pdf","title":""},{"url":"https://www.edpb.europa.eu/system/files/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf","title":""},{"url":"https://www.amnesty.org/en/latest/news/2026/04/eu-simplification-laws","title":""},{"url":"https://www.euractiv.com/news/council-deletes-revised-definition-of-personal-data-from-gdpr-omnibus/","title":""}],"viewCount":4,"publishedAt":"2026-04-17T07:47:37.292Z","createdAt":"2026-04-17T07:47:37.292Z","articlePublishedAt":"2026-04-15T00:00:00.000Z"}