Council drops AI 'legitimate interest' basis in GDPR plan

TL;DR

EU Council proposes removing a specific new provision allowing "legitimate interest" as legal basis for personal data processing in AI development under GDPR amendments.
A compromise text dated 15 April 2026, seen by Euractiv, follows privacy authorities' view that existing GDPR rules already cover this without new text.[[1]](https://www.euractiv.com/news/council-moves-to-drop-legitimate-interest-legal-basis-for-ai-in-gdpr-proposal)[[2]](https://table.media/assets/berlin/digitalomnibus.pdf)
This prioritizes data protection over simplifying AI rules, amid Digital Omnibus talks to ease tech compliance.

The story at a glance

The EU Council, representing member states, issued a compromise on 15 April 2026 in Digital Omnibus negotiations to drop a proposed addition explicitly permitting "legitimate interest" (GDPR Article 6(1)(f)) for AI-related personal data processing.[[2]](https://table.media/assets/berlin/digitalomnibus.pdf) This follows EDPB and EDPS opinions that no new provision is needed, as legitimate interest can already apply case-by-case under current rules.[[3]](https://www.edpb.europa.eu/system/files/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf) The change comes as the EU balances AI innovation with privacy in ongoing trilogues.

Key points

Original Commission Digital Omnibus proposal (late 2025) sought to add Article 88c GDPR clarifying legitimate interest for AI model development and operation, with safeguards like right to object.[[2]](https://table.media/assets/berlin/digitalomnibus.pdf)
EDPB/EDPS Joint Opinion 2/2026 (Feb 2026) agreed legitimate interest may work for some AI cases but said it's unnecessary to codify, as their prior Opinion 28/2024 already confirms it under existing GDPR; suggested recital over new article if pursued.[[3]](https://www.edpb.europa.eu/system/files/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf)
Council's 15 April compromise removes this specific AI carve-out, aligning with privacy hawks' caution against easing consent requirements for vast AI training datasets.[[1]](https://www.euractiv.com/news/council-moves-to-drop-legitimate-interest-legal-basis-for-ai-in-gdpr-proposal)
Retains other simplifications like derogations for incidental special category data in AI (e.g., Article 9(2)(k) GDPR) and pseudonymisation guidance.
Part of broader Digital Omnibus aiming to cut red tape on GDPR, AI Act, Data Act via templates, delayed deadlines, single breach reporting point.
No quotes from Council text leaked; Euractiv reporting based on document seen by them.

Details and context

The Digital Omnibus, proposed by Commission in late 2025, targets "competitiveness" by tweaking GDPR/AI Act burdens post-Draghi report, including AI data use for training without always needing consent.[[4]](https://www.amnesty.org/en/latest/news/2026/04/eu-simplification-laws) Privacy groups warned this risks "rolling back rights" by narrowing personal data scope and blanket legitimate interest for AI.[[2]](https://table.media/assets/berlin/digitalomnibus.pdf)

Council's move echoes earlier Feb 2026 compromise deleting Commission's narrower "personal data" definition, deferring to EDPB pseudonymisation guidelines.[[5]](https://www.euractiv.com/news/council-deletes-revised-definition-of-personal-data-from-gdpr-omnibus/) For AI, dropping the provision avoids controversy but keeps general legitimate interest viable via balancing test (necessity vs data subject rights), as EDPB outlined—no automatic opt-out for AI firms.

Trade-off: Slows AI data access (e.g., no explicit nod to bias mitigation as overriding interest) but upholds GDPR's strict consent norm, especially for special data. Earlier leaks showed retention in some drafts, but April text shifts conservative.[[2]](https://table.media/assets/berlin/digitalomnibus.pdf)

Why it matters

EU data rules shape global AI norms via "Brussels effect," so retaining caution on legitimate interest signals privacy trumps unchecked training on personal data.

AI developers face higher consent hurdles for EU data, raising costs/complexity versus US flexibility, while users gain stronger objection rights.

Watch trilogues with Parliament (pro-simplification lean) for final text; outcome likely by mid-2026, before AI Act high-risk rules hit.