Cybersecurity Policy Report, ‘Targeted’ Changes Proposed for EU Privacy Law to Boost AI, Ease Regulatory Burden, (Nov 19, 2025)

By Tom Leithauser

The European Commission today unveiled what it described as “targeted amendments” to European privacy law, while critics accused the EC of gutting the law for technology firms that would benefit from looser rules around the use of Europeans’ data for training artificial intelligence systems, among other things.

A redefinition of what constitutes “personal data” is one of the key provisions of the EC’s “omnibus” regulatory proposal. The change would add new carve-outs to the definition contained in article 4 of the European Union’s General Data Protection Regulation (GDPR).

“Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person,” the new definition would say.

“Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity,” according to the proposed new definition.

The EC explained that the new definition would conform to a ruling by the Court of Justice of the EU, which recently said a lower court was correct in holding that pseudonymized data shouldn’t be regarded, in all cases and for every person, as personal data under the GDPR.

The redefinition and other aspects of the amended regulations are expected to make more European data available for AI training and reduce businesses’ cost of compliance. Overall, the changes proposed by the omnibus package to the GDPR and other EU regulations will save the private sector 5 billion euros ($5.77 billion) in “administrative costs” by 2029, the EC said in a news release.

Michael McGrath, the EC’s commissioner–democracy, justice, the rule of law, and consumer protection, insisted in a press briefing that the proposed amendments to the GDPR were “clarifications of existing concepts and principles, not a reopening of the GDPR.”

“Today’s proposed changes are based on continuous dialogue with stakeholders during this last year,” he said. “Overall, there was no call for a general reopening of the GDPR. In simple terms, the GDPR works. However, it became clear that targeted measures to further harmonise the application of the GDPR and to simplify certain obligations are required.”

Henna Virkkunen, the EC’s executive vice-president, characterized the changes to the GDPR as a “face-lift.”

“We are giving a face-lift with targeted amendments to the GDPR that reflect how technologies have evolved. In particular, we are adopting measures to ensure that AI development is encouraged in Europe and clearly framed by our rules,” Ms. Virkkunen said.

“We must move from rulemaking to innovation-building. Our rules should not be a burden, but an added value. For this, we need immediate steps to get rid of regulatory ‘clutter,’ where there is any, and focus instead on clear and predictable rules, and solid enforcement,” she said.

Other provisions of the omnibus regulatory package would enable Internet users to refuse or accept the placement of tracking cookies on their devices with a “single click” that would record their choice on their device and transmit it to all of the sites they visit, Ms. Virkkunen noted.

“We are finally addressing cookie banner fatigue. I think we can all agree we have spent too much of our time accepting or rejecting cookies every time we visit a website,” she said.

The regulatory omnibus also aims to simplify cybersecurity incident reporting by establishing “a single-entry point where companies can meet all incident-reporting obligations,” the EC said.

“Currently, companies must report cybersecurity incidents under several laws, including among others the NIS2 Directive, the General Data Protection Regulation (GDPR), and the Digital Operational Resilience Act (DORA). The interface will be developed with robust security safeguards and will undergo comprehensive testing to ensure its reliability and effectiveness,” it said.

Along with the omnibus regulatory proposal, the EC introduced a Data Union Strategy “to unlock high-quality data for AI” and European Business Wallets “that will offer companies a single digital identity to simplify paperwork and make it much easier to do business across EU Member States,” it said.

Release of the regulatory package will kick off what’s expected to be robust debates in the European Parliament and the Council of the EU. Some EU privacy watchdogs have already made their views known, including the European Center for Digital Rights (NOYB) (CPR, Nov. 10), which today reiterated its opposition.

“Industry lobby groups have successfully used the European fear of global economic pressure to call for massive cuts to Europeans’ digital rights. The abrupt changes that were proposed today may undermine more than 40 years of a clear European stance against commercial surveillance by private actors,” NOYB said in a news release.

“The proposed reform of the GDPR seems to primarily aim at removing any obstacles that could limit the use of personal data, such as social media data, for AI. However, many of these changes would have massive consequences to society in other areas than AI, such as online advertisement,” the group added.

“The Digital Omnibus would mainly benefit big tech, while failing to provide any tangible benefits to average EU companies. This proposed reform is a sign of panic around shaping Europe’s digital future, not a sign of leadership. What we really need is a strategic, well-designed long-term plan to move Europe ahead,” said Max Schrems, NOYB’s co-founder.

The Computer & Communications Industry Association (CCIA), on the other hand, called for “deeper reform of the EU’s digital rulebook.”

“Today’s Digital Omnibus is a promising first step towards simplifying EU tech rules,” Alexandre Roure, CCIA Europe’s policy head, said in a statement. “But its narrow scope leaves much of the EU’s patchwork untouched. Unprecedented regulatory complexity and legal uncertainty act as a direct tax on Europe’s competitiveness and innovation. Efforts to simplify digital and tech rules cannot stop here.”

MainStory: TopStory InternationalLegislation DataSecurity DataPrivacy AINews GDPR