Digital Omnibus: "The EU Commission is shaking the cornerstones of data protection"

The European Commission is proposing significant changes to data protection regulations, aiming to carve out certain pseudonymized data from the scope of the General Data Protection Regulation (GDPR). This move, part of a broader "digital omnibus" package designed to streamline digital legislation, has drawn sharp criticism from data protection authorities. The core of the debate lies in redefining what constitutes personal data, potentially weakening fundamental privacy protections. At the heart of the controversy is the Commission's proposed reclassification of pseudonymized data. Currently, data that can be linked back to an individual, even with additional information, is generally considered personal and falls under GDPR. The proposed change suggests that if re-identification is not immediately feasible, such data might no longer be subject to the regulation, significantly impacting its protection. This policy shift could have far-reaching implications for individuals and businesses across the EU. While the Commission frames the changes as simplifications and a way to foster innovation, privacy advocates argue it represents a rollback of crucial data protection standards. Critics, like the Berliner Datenschutzbeauftragte Meike Kamp, believe this interpretation misapprehends existing European Court of Justice rulings and risks undermining digital rights. The "digital omnibus" package encompasses a wider array of digital policy adjustments, including proposed revisions to rules concerning AI, IT security incident reporting, and cookie banners. However, the potential exclusion of pseudonymized data from GDPR protections stands out as a particularly contentious point, signaling a critical juncture in the ongoing development of Europe's digital privacy landscape.