Cybersecurity Policy Report, EU Lawmakers Push Back on Proposed Narrowing of ‘Personal Data’ Definition, (Oct 22, 2026)
The Council of the European Union has rejected the European Commission’s proposal to amend the EU’s General Data Protection Regulation (GDPR) by narrowing the definition of “personal data.”
The commission last year unveiled “targeted amendments” to GDPR that included a proposal to redefine personal data to exclude pseudonymized data that can’t be easily used to identify an individual (CPR, Nov. 19, 2025).
But the council recommended keeping the old definition in a proposal released yesterday that reflects the council’s position, known as a “mandate,” on a “digital omnibus” that aims to alleviate EU businesses’ compliance burdens. The council’s proposed GDPR amendments would retain the old definition and offer new provisions regarding the use of pseudonymization to protect personal data.
“It is important to recall that, for a controller applying pseudonymisation or a processor processing on behalf of the controller, the data subject remains identifiable and therefore Regulation (EU) 2016/679 [GDPR] applies,” it says.
“Data may become ‘personal’ where they are put at the disposal of other persons who have means reasonably likely to enable the data subject to be identified. This applies to both the party that transmits this data and the third party that subsequently processes this data,” it adds.
The council’s proposal, known as a mandate, “maintains the current definition of personal data and introduces a new provision on pseudonymisation and the identification of a natural person, with a view to helping companies comply with their GDPR obligations by clarifying rules in this area,” according to a council news release.
The council also disagreed with a commission proposal to create a single portal for reporting data breaches and cybersecurity incidents. The council proposed allowing each EU nation “to develop, maintain and securely operate” their own reporting portals.
“The Council mandate replaces the proposed single-entry point at the EU level by the establishment of a national entry point in each member state, supporting and facilitating the reporting of incidents and related events under different EU laws,” it said in its news release.
“Furthermore, the Council mandate proposes the establishment of an incident reporting information point at the EU level, as well as specific provisions towards a harmonised framework for incident notification and on cross-border incident notifications,” it added.
It also proposed changes to the commission’s plan for a “derogation” that would relax data protection rules to enable the training of AI (artificial intelligence) models to boost Europe’s AI sector.
The council recommended additional “safeguards to the newly proposed derogation allowing for the processing of sensitive data for the purpose of biometric verification and in the context of the development and operation of AI systems,” it said.
“Innovation and the development of AI are further supported with clarifications on the lawful ground for processing personal data and the need to maintain appropriate safeguards,” it said.
But the council agreed with the commission’s proposal to reduce “cookie banner fatigue” that results when individuals have to click to accept cookie trackers every time they visit a website.
“The Council mandate maintains the [commission’s proposed] rules on cookies and other kinds of online tracking technologies under the e-privacy directive,” it said.
“This framework is updated with clearer and additional purposes where consent will not be required for the placing of cookies on a user device, thus reducing the number of cookie banners when navigating online. This would apply, for example, when necessary for the provision of a service, for the purpose of audience measurement or for ensuring the security of the user’s device,” it added.
Leaders of the council, which is one of two EU legislative bodies and includes representatives from each EU member state, generally agreed with the commission’s effort to simplify EU law to alleviate compliance burdens.
“Simplifying and streamlining the EU’s digital rulebook will make it easier for businesses to operate across Europe, reducing administrative burdens while maintaining high standards for data privacy and citizens’ rights,” said Helen McEntee, Ireland’s minister for Foreign Affairs and Trade. Ireland currently occupies the council’s presidency.
“The Irish presidency has worked to secure a timely agreement in Council so that these improvements can start delivering real benefits sooner. This is an important step in ensuring Europe remains an attractive place to invest, innovate and grow trusted digital businesses,” Ms. McEntee said.
The EU Parliament still hasn’t finalized its recommendations on the commission’s omnibus legislation. Once it does, the council and parliament will negotiate a final proposal to present to the commission.
MainStory: TopStory InternationalLegislation DataPrivacy DataSecurity GDPR