European Commission ‘simplification’ proposal would weaken GDPR, AI regulations

The European Commission on Wednesday unveiled a proposal for sweeping changes to the European Union’s General Data Protection Regulation (GDPR) and AI Act in a deregulatory push which officials say will stoke innovation.

Under the proposal, the EU would weaken data protection rules by delaying when regulations governing high-risk AI systems take effect and allowing companies to use personal data for AI training without prior consent from users in most circumstances.

The package, known as the Digital Omnibus, also undercuts the GDPR by not applying it in any instances other than when companies storing data can identify a specific individual. The proposal also includes language which would simplify cookie permission pop-ups.

If approved by legislators, the changes will strip Europeans of data privacy protections that have long been the toughest in the world but which big tech and the U.S. government say is onerous.

Whether members of the European Parliament and Council will greenlight the changes remains an open question. After a draft of the proposal leaked earlier this month, progressive and center political parties spoke up against deregulation.

Key EU commissioners have indicated they view new rules as essential, saying the bloc must simplify its laws to compete, particularly in a world where artificial intelligence is quickly developing and fueling massive economic growth.

“Our companies, especially our start-ups and small businesses, are often held back by layers of rigid rules,” Henna Virkkunen, executive vice-president for tech sovereignty, security and democracy, said in a statement. “By cutting red tape, simplifying EU laws [and] opening access to data… we are giving space for innovation to happen and to be marketed in Europe.”

Virkunnen said that the rules in the proposal ensure that users' fundamental rights are protected, an assertion which privacy and digital rights advocates attacked.

“Taken together, these changes give both state authorities and powerful companies more room to collect and process personal information with limited oversight and reduced transparency,” the advocacy group European Digital Rights (eDRI) said in a press release. “People will lose straightforward safeguards, and minoritised communities will face even higher exposure to profiling, automated decisions and intrusive monitoring.”

A push to ‘move fast and break things’

Critics ridiculed commission officials' contention that the changes will benefit small and medium-size businesses.

“While the Commission constantly argues that this reform would be good for small companies, there is very little for them in these changes,” Max Schrems, the founder of the digital privacy advocacy group noyb, said in a statement. “The only real beneficiary here is big tech and law firms.”

The changes will make the market more concentrated and raise legal questions, which will hamper smaller companies, Schrems said.

Advocates were blindsided when the draft proposal leaked because the changes set forth far exceeded what the Commission had said it was going to do. Officials did not consult with external stakeholders when drafting the proposal.

“These changes happened without proper procedures and are not based on evidence but rather on fear and industry claims,” Schrems said. “'Move fast and break things' is not a motto that works to push through legislation affecting not only the lives of 450 million people, but ultimately also the proper functioning of our societies and democracies."

The Digital Omnibus also contains other less sweeping amendments, including a proposal for an easier way for companies to report cybersecurity events, less complex AI documentation requirements for small companies and more concentrated oversight of AI by placing supervisory authority under the purview of a single office.