What happened
On 21-22 October 2026 the Council of the EU (member states, under the Irish presidency) adopted its negotiating 'mandate' on the Commission's proposed digital omnibus amending GDPR. The Council position: (1) rejects narrowing the definition of 'personal data' and keeps the existing definition; (2) introduces a new provision on pseudonymisation and identification of a natural person; (3) adds safeguards to the proposed derogation permitting processing of sensitive data for biometric verification and in the development and operation of AI systems (i.e. AI model training); (4) rejects a single EU-level breach/incident reporting portal in favour of national entry points plus an EU-level incident-reporting information point; and (5) maintains eased cookie-consent rules.
Why it matters
This is a live EU legislative development that directly sets the data-law foundation for AI development. The Council's position on the AI-training data derogation and on special-category data processing for AI system development/operation is the key lever for which personal data may be used to train or operate AI in the EU, and the retained broad 'personal data' definition means pseudonymised AI-training data stays inside GDPR. It shapes the final GDPR/AI-omnibus text negotiated with the European Parliament and could materially change lawful bases, 'legitimate interest' tests and biometric/AI processing conditions for EU and non-EU AI providers serving the EU market.
Action needed
EU (and EU-serving) AI developers and data controllers should track the trilogue on the digital omnibus, prepare for the new pseudonymisation and sensitive-data derivation safeguards, and review the lawful ground for any personal-data-based AI training/processing to align with the emerging derogation conditions.