noyb has joined forces with EDRi and the Irish Council for Civil Liberties (ICCL) to send an open letter to the EU Commission. There are serious concerns about the potential threat that the internal draft for the Digital Omnibus poses to Europeans' fundamental rights. The Commission has secretly set in motion a potentially massive reform of the GDPR. If internal drafts become reality, this would have significant impact on people's fundamental right to privacy and data protection. Instead of the announced targeted adjustments, the Commission proposes changes to core elements like the definition of personal data and data subject rights under the GDPR. The leaked draft also suggests to give AI companies a blank check to suck up European's personal data. This is highly concerning.
- Detailed noyb analysis of the Commission draft
- Full text of Commission draft (via Netzpolitik.org)
Secret "fast-track" attack on the GDPR. The European Commission plans to simplify several EU laws via a so-called "Omnibus" reform, a tool that normally changes various smaller elements of several laws horizontally. However, as was revealed, the European Commission is working on a massive reform of the GDPR under the heading of alleged "simplification" or "clarifications". Among other things, the Commission proposes changes to core elements like the definition of "personal data" and all data subject's rights under the GDPR. The leaked draft also suggests to give AI companies (like Google, Meta or OpenAI) a blank check to suck up European's personal data. In addition, the special protection of sensitive data like health data, political views or sexual orientation would be significantly reduced. Also, remote access to personal data on PCs or smart phones without consent of the user would be enabled.
Joint open letter to the Commission. This is highly concerning. Therefore, noyb has joined forced with EDRi and the Irish Council for Civil Liberties (ICCL) to send an open letter to the Commissioners Virkkunen and Michael McGrath (DG Justice).
We agree that the digital acquis should be consistent and that its application should be coordinated. However, the legislative changes now contemplated go far beyond mere simplification. They would de-regulate core elements of the GDPR, the e-Privacy framework and AI Act, significantly reducing established protections.
Necessary evidence not gathered. The considered changes go against the assurances given to stakeholders during the Commission’s GDPR Implementation Dialogue, and have not been anticipated neither in the 2025 Overview Report on Simplification, Implementation and Enforcement, nor in the Call for Evidence for the Digital Omnibus. It is apparent that the Commission has not gathered the necessary evidence and consulted sufficiently, nor has it conducted the necessary impact assessment to support such profound amendments, which are potentially in conflict with the European Charter of Fundamental Rights.
All our concerns are summarised in detail here.
