Cybersecurity Policy Report, Proposed Updates to EU Privacy Law Flagged by Consumer Advocate, (Sep 25, 2026)

By Tony Foley

The European Consumer Organization (BEUC) has asked the Council of the European Union to reconsider its latest version of the Digital Omnibus, arguing that the compromise proposal put forth by the Irish presidency of the council “threatens to undo over a decade of regulatory refinement and legal precedence, placing the personal data of millions of Europeans directly in the hands of US Big Tech.”

BEUC said in a press release that at a time when user data is facing growing exploitation, the proposal would fundamentally weaken consumer safeguards and could render the European Union’s General Data Protection Regulation (GDPR) unworkable.

Specifically, BEUC’s letter to the council addresses the organization’s concerns regarding the following provisions in the latest proposal:

AI development and operation (article 88bis). Despite warnings from multiple sources in the AI (artificial intelligence) industry itself concerning slowing down the pace of AI development, BEUC maintained that the current proposal moved in the opposite direction, in that it would allow for the processing of any personal data for any purpose via an AI system using the legitimate interests legal basis. The organization said that allowing such processing without the express consent of consumers risks exposing people to harmful practices and stripping them of their right to object to the processing.

Pseudonymized data and definitions of personal data (article 25a). The current proposal adds a new provision that reintroduces the concept of pseudonymized data to the Digital Omnibus. It provides that pseudonymized data will not be considered personal data for a third party if that person is unable to identify the natural person to whom the data relates. BEUC argued that this would create a subjective assessment of what is and isn’t personal data under the law, effectively allowing companies to decide whether or not they choose to comply with the GDPR.

BEUC explained that the broad definition described above is in direct contradiction to GDPR article 4(5), which establishes that pseudonymization means the processing of personal data. Accordingly, pseudonyms like ID numbers, nicknames, usernames, and phone numbers must be considered a subset of personal data. The organization maintained that the proposal, by allowing a broad, subjective interpretation of what constitutes personal data, would effectively exempt some of the largest data processing industries from the scope of the GDPR.

“BEUC calls on Member States to reconsider this proposal, to ensure the Digital Omnibus does not undermine European consumers’ rights and more fundamentally that it does not unnecessarily expose them to potential harmful AI practices stemming from the use of their personal data,” the letter concluded.

News: InternationalLegislation DataPrivacy GDPR